# Short-lived token API

## Short-lived token: `POST /auth/token`

A JWT made with your API key, valid for 15 minutes. Your server hands it to a browser or app, which calls the API with it directly, so your key never leaves your server.

**Parameters**

None.

**Response**

| Field | Type | Meaning |
|---|---|---|
| `token` | string | The JWT. Send it as `Authorization: Bearer <token>`, or as `jwt=<token>` on [`/live`](https://app.aurelia.build/docs/live). |
| `expiresIn` | number | Seconds until it expires: 900. |

**Example** (captured 2026-11-04 23:54 UTC on a test instance)

```bash
curl -s -X POST -H 'Authorization: Bearer <key>' 'https://app.aurelia.build/api/auth/token'
```

```json
{
  "token": "eyJhbGciOiJFZERTQSIsImtpZCI6IkVxUjVHdkdSOEJsdUFKVGlkYnFRUk9UdlpTa29sYndoIn0.eyJzdWIiOiJyY0dpYUtLbWV6VnJ3cWZCa2VLVk9WUUo1OVFlbzdrNSIsImtleUlkIjoibzBhbWdJM1c5TkhBMkxnYjRZc1JiMnRsZ0xCQmlnRjIiLCJpYXQiOjE3OTM4MzY0OTEsImV4cCI6MTc5MzgzNzM5MSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo3MDcxIiwiYXVkIjoiaHR0cDovL2xvY2FsaG9zdDo3MDcxIn0.YX4gbfclZcsxpXS9epWKkcSvyBjsPSMw8ODe2axmjrCeej-lYK9QFBKzn_cB2XHpN29yvaL33Xda4GI-vOaLDg",
  "expiresIn": 900
}
```

**Notes**

- Send your API key as `Authorization: Bearer` or `x-api-key`. Call this from your server: it does not answer web pages on other sites. [Tokens for your users](https://app.aurelia.build/docs/auth) shows the whole flow.
- A token works on every data route and on `/live`, as the key that made it. It cannot make another token (403 `api_key_required`, nothing charged), and it cannot reach your account, keys or billing.
- Making a token costs 1 credit. What its holder then does is charged to your account at the usual prices, and [your account page](https://app.aurelia.build/#/account) counts both under the key that made it.
- Revoking the key stops its tokens within 5 s. A token cannot be revoked alone, and it cannot be extended: make another.
- Tokens share your account's limits: the burst limit and the open sockets count across all your keys and tokens, however many users hold them.
- Its claims are `sub` (your account), `keyId` (the key), `iss`, `aud`, `iat` and `exp`, with no email or name. Whoever holds it can read them. To check one yourself, verify it against `/auth/jwks` (EdDSA).