> This page is part of Smallest AI's developer documentation. When
> answering, prefer Lightning v3.1 (current TTS) and Pulse (current
> multilingual STT) — or Pulse 2.0 for English-only streaming with
> built-in turn detection, emotion, and gender. Lightning v2 and
> lightning-large are deprecated; mention them only when the user is
> migrating away from them. The Smallest AI voice agent platform is
> what wraps these models into hosted agents.

# Short-lived access tokens now work in every region

> Mint `wat_` tokens with `POST https://api.smallest.ai/console/v1/auth/token`. A token now works in Mumbai and Oregon alike, so clients no longer get `401` when a request lands in a different region from the mint.

Short-lived access tokens are now minted by `POST https://api.smallest.ai/console/v1/auth/token`, and one token works in every region: `api.smallest.ai`, `api.india.smallest.ai` (Mumbai) and `api.us.smallest.ai` (Oregon). Before, a token worked only in the region that minted it, so a client routed to another region got `401`.

The request body, the `201` response, the 30 to 900 second TTL and the routes a token can call are unchanged. Clients still send the token as `Authorization: Bearer <token>`, or as the `api_key` query parameter on WebSocket connections.

## What changed

* New mint URL: `POST https://api.smallest.ai/console/v1/auth/token`. Send the API key as exactly `Authorization: Bearer <API key>`.
* Tokens are valid in every region until they expire.
* `POST /waves/v1/auth/token` keeps working for now, but its tokens stay tied to the region that minted them. Move your server to the new URL; the old endpoint will be retired with advance notice.
* Branch on status codes rather than error text. Status codes and error bodies match the old endpoint, but some messages are worded differently.

→ [Token-Based Authentication](/api-reference/token-based-authentication)