Create Access Token

Mint a short-lived access token from your API key. Call this from your server, then hand the returned access_token to a browser or mobile client. The client sends it as Authorization: Bearer <access_token> on TTS, STT and speech-to-speech requests. On WebSocket connections it can also go in the api_key query parameter. HTTP requests must use the header.

A token works any number of times until it expires. It is accepted only on TTS, STT and speech-to-speech inference routes: POST /waves/v1/stt/, WSS /waves/v1/stt/live, POST /waves/v1/tts, POST /waves/v1/tts/live, WSS /waves/v1/tts/live, the dedicated Lightning v3.1 routes (POST /waves/v1/lightning-v3.1/get_speech, POST /waves/v1/lightning-v3.1/stream, WSS /waves/v1/lightning-v3.1/get_speech/stream), WSS /waves/v1/s2s, and the voice-listing routes (public catalog, no cloned voices). Treat any route not listed as unavailable to tokens. This endpoint, POST /waves/v1/pulse/get_text, voice cloning, pronunciation dictionaries, analytics and chat completions return 403 to a token.

Requests made with a token are billed to the API key that minted it. Deleting that key invalidates its tokens. A token is valid only in the region that minted it. If your server and your users can be in different regions, mint and call through the same region-pinned hostname: api.india.smallest.ai (Mumbai) or api.us.smallest.ai (Oregon).

curl -X POST "https://api.smallest.ai/waves/v1/auth/token" \
  -H "Authorization: Bearer $SMALLEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ttl_seconds": 300}'

See the Authentication guide for the end-to-end server and client flow.