Tokens
Create a one-time token
Mints a single-use, short-lived bearer token from the API key that authenticates this request. The token authenticates exactly one HTTP request or WebSocket connection to the APIs its parent key can reach, then expires. Authenticate with the API key itself — bearer callers are refused. See the one-time tokens guide for semantics and client patterns.
/auth/v1/tokensAuthorizationstringrequired
Your authentication credentials. Populate Basic $INWORLD_API_KEY — one-time tokens are minted with the parent API key itself, never with a bearer token.
single_usebooleanrequired
Must be true. Only single-use tokens are supported; the token is consumed by its first successful authentication.
ttlstring
How long the token stays valid, as a duration in seconds (e.g. "300s"). Minimum 1 second, maximum 1 hour; defaults to 15 minutes. Mutually exclusive with expire_time.
expire_timestring
Absolute expiry timestamp, as an alternative to ttl. Capped at 1 hour from now. Mutually exclusive with ttl.
client_reference_idstring
Optional correlation ID of your own (for example a user or session ID). Printable ASCII, at most 256 characters. Echoed in the response and attached to the token for usage attribution.
namestring
The token's resource name, tokens/{token}. This is the token's stable ID — safe to log and correlate on.
accessTokenstring
The bearer credential. Returned only in this response and never stored — send it as Authorization: Bearer <accessToken>, or as Sec-WebSocket-Protocol: bearer_<accessToken> on browser WebSocket connections.
expireTimestring
When the token expires.
singleUseboolean
Always true. The token is consumed by its first successful authentication.
clientReferenceIdstring
The correlation ID from the request, if one was given.
createTimestring
When the token was minted.
apiKeystring
Resource name of the parent API key, workspaces/{workspace}/apikeys/{key}. Deleting that key immediately invalidates this token.