Short-lived token API
POST/auth/token
A JWT made with your API key, valid for 15 minutes. Your server hands it to a browser or app, which calls the API with it directly, so your key never leaves your server.
Parameters
None.
Response
| Field | Type | Meaning |
|---|---|---|
token | string | The JWT. Send it as Authorization: Bearer <token>, or as jwt=<token> on /live. |
expiresIn | number | Seconds until it expires: 900. |
Example
Captured 2026-11-04 23:54 UTC on a test instance.
curl -s -X POST -H 'Authorization: Bearer <key>' 'https://app.aurelia.build/api/auth/token'
{
"token": "eyJhbGciOiJFZERTQSIsImtpZCI6IkVxUjVHdkdSOEJsdUFKVGlkYnFRUk9UdlpTa29sYndoIn0.eyJzdWIiOiJyY0dpYUtLbWV6VnJ3cWZCa2VLVk9WUUo1OVFlbzdrNSIsImtleUlkIjoibzBhbWdJM1c5TkhBMkxnYjRZc1JiMnRsZ0xCQmlnRjIiLCJpYXQiOjE3OTM4MzY0OTEsImV4cCI6MTc5MzgzNzM5MSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo3MDcxIiwiYXVkIjoiaHR0cDovL2xvY2FsaG9zdDo3MDcxIn0.YX4gbfclZcsxpXS9epWKkcSvyBjsPSMw8ODe2axmjrCeej-lYK9QFBKzn_cB2XHpN29yvaL33Xda4GI-vOaLDg",
"expiresIn": 900
}
Notes
- Send your API key as
Authorization: Bearerorx-api-key. Call this from your server: it does not answer web pages on other sites. Tokens for your users shows the whole flow. - A token works on every data route and on
/live, as the key that made it. It cannot make another token (403api_key_required, nothing charged), and it cannot reach your account, keys or billing. - Making a token costs 1 credit. What its holder then does is charged to your account at the usual prices, and your account page counts both under the key that made it.
- Revoking the key stops its tokens within 5 s. A token cannot be revoked alone, and it cannot be extended: make another.
- Tokens share your account's limits: the burst limit and the open sockets count across all your keys and tokens, however many users hold them.
- Its claims are
sub(your account),keyId(the key),iss,aud,iatandexp, with no email or name. Whoever holds it can read them. To check one yourself, verify it against/auth/jwks(EdDSA).
Free to start: 10,000 credits, with no card and no subscription.