Create Access Token

Mint a short-lived access token from your API key. Call this from your server, then hand the returned `access_token` to a browser or mobile client. The client sends it as `Authorization: Bearer <access_token>` on TTS, STT and speech-to-speech requests. On WebSocket connections it can also go in the `api_key` query parameter. HTTP requests must use the header. A token works any number of times until it expires. It is accepted only on TTS, STT and speech-to-speech inference routes: `POST /waves/v1/stt/`, `WSS /waves/v1/stt/live`, `POST /waves/v1/tts`, `POST /waves/v1/tts/live`, `WSS /waves/v1/tts/live`, the dedicated Lightning v3.1 routes (`POST /waves/v1/lightning-v3.1/get_speech`, `POST /waves/v1/lightning-v3.1/stream`, `WSS /waves/v1/lightning-v3.1/get_speech/stream`), `WSS /waves/v1/s2s`, and the voice-listing routes (public catalog, no cloned voices). Treat any route not listed as unavailable to tokens. This endpoint, `POST /waves/v1/pulse/get_text`, voice cloning, pronunciation dictionaries, analytics and chat completions return `403` to a token. Requests made with a token are billed to the API key that minted it. Deleting that key invalidates its tokens. A token is valid only in the region that minted it. If your server and your users can be in different regions, mint and call through the same region-pinned hostname: `api.india.smallest.ai` (Mumbai) or `api.us.smallest.ai` (Oregon). ```bash curl -X POST "https://api.smallest.ai/waves/v1/auth/token" \ -H "Authorization: Bearer $SMALLEST_API_KEY" \ -H "Content-Type: application/json" \ -d '{"ttl_seconds": 300}' ``` See the [Authentication guide](/models/api-reference/token-based-authentication) for the end-to-end server and client flow.