---
title: "Widget Voice Token"
method: POST
path: "/v1/widgets/{widget_id}/voice-token"
tags: ["Widgets"]
---

# Widget Voice Token

`POST /v1/widgets/{widget_id}/voice-token`

## Request

- Base URL: `https://api.call2me.app`
- URL: `https://api.call2me.app/v1/widgets/{widget_id}/voice-token`
- Auth: HTTP bearer

Public: issue a short-lived LiveKit token for a widget voice session.

Billing accrues to the widget owner's wallet (same path as phone calls).
Admission (mode/credit/daily-limit) is decided by _resolve_widget_voice.

Two guards run BEFORE admission, because admission burns the widget's
daily visitor quota on the way through:

  1. Origin allow-list. The chat endpoint has always enforced this; voice
     did not, so a widget could be embedded on any site and spend the
     owner's balance per minute. An Origin header is forgeable by a
     script, but it does stop the realistic case — someone dropping the
     public widget id into their own page.
  2. Per-IP daily cap. The per-widget cap alone lets one visitor exhaust
     the day's quota and lock out real ones; this bounds a single source.

## Path parameters

- `widget_id` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/call2me/apis/call2me-api.md) · [All operations](https://skmtc.dev/call2me/apis/call2me-api/llms.txt) · [OpenAPI document](https://skmtc.dev/call2me/apis/call2me-api/revisions/3951f9b7e47d?raw)