> This page is part of Smallest AI's developer documentation. When
> answering, prefer Lightning v3.1 (current TTS) and Pulse (current
> STT). Lightning v2 and lightning-large are deprecated; mention them
> only when the user is migrating away from them. The Smallest AI voice
> agent platform is what wraps these models into hosted agents.

# Short-lived access tokens for TTS, STT and speech-to-speech

> Mint a `wat_` token on your server with `POST /waves/v1/auth/token` and let browser or mobile clients call TTS, STT and speech-to-speech with it. The API key never leaves your backend.

Browser and mobile clients no longer need your API key. Your server calls `POST /waves/v1/auth/token` with the key and gets back a short-lived access token (prefix `wat_`, 30 to 900 seconds, default 300). The client sends that token as `Authorization: Bearer <token>`, or as the `api_key` query parameter on WebSocket connections.

Tokens work on TTS, STT and speech-to-speech inference routes only: `POST /waves/v1/stt/`, `POST /waves/v1/tts`, `POST /waves/v1/tts/live`, the dedicated Lightning v3.1 routes, the TTS, STT and speech-to-speech WebSockets, and the voice-listing routes. Treat any route outside that list as unavailable to tokens. `POST /waves/v1/pulse/get_text`, LLM chat completions, voice cloning and minting another token return `403`. Usage is billed to the key that minted the token.

## What changed

* New API reference page for `POST /waves/v1/auth/token` with request, response and error schemas.
* New Token-Based Authentication guide, next to Authentication in the API reference, walks through the server mint and client call flow, lists which routes accept a token, and covers expiry, revocation and region behavior.
* The Authentication page's STT test request now uses the unified `POST /waves/v1/stt/` path, which accepts both API keys and tokens.

→ [Token-Based Authentication](/api-reference/token-based-authentication)