Realtime TTS-2 is live. Built for realtime conversation that feels human. Read the Realtime TTS-2 announcement

Tokens

Create a one-time token

Create a single-use, short-lived bearer token from your Inworld API key. Use it to authenticate one HTTP request or WebSocket connection from a browser or mobile app.

POST/auth/v1/tokens

Authorizations

Authorizationstringrequired

Your authentication credentials. Populate Basic $INWORLD_API_KEY — one-time tokens are minted with the parent API key itself, never with a bearer token.

Body

application/json

single_usebooleanrequired

Must be true. Only single-use tokens are supported; the token is consumed by its first successful authentication.

ttlstring

How long the token stays valid, as a duration in seconds (e.g. "300s"). Minimum 1 second, maximum 1 hour; defaults to 15 minutes. Mutually exclusive with expire_time.

expire_timestring

Absolute expiry timestamp, as an alternative to ttl. Capped at 1 hour from now. Mutually exclusive with ttl.

client_reference_idstring

Optional correlation ID of your own (for example a user or session ID). Printable ASCII, at most 256 characters. Echoed in the response and attached to the token for usage attribution.

Response

200 - application/json

namestring

The token's resource name, tokens/{token}. This is the token's stable ID — safe to log and correlate on.

accessTokenstring

The bearer credential. Returned only in this response and never stored — send it as Authorization: Bearer <accessToken>, or as Sec-WebSocket-Protocol: bearer_<accessToken> on browser WebSocket connections.

expireTimestring

When the token expires.

singleUseboolean

Always true. The token is consumed by its first successful authentication.

clientReferenceIdstring

The correlation ID from the request, if one was given.

createTimestring

When the token was minted.

apiKeystring

Resource name of the parent API key, workspaces/{workspace}/apikeys/{key}. Deleting that key immediately invalidates this token.