---
title: "Mint a short-lived token for one website (from your server)"
method: POST
path: "/elements/v1/tokens"
tags: ["Website components"]
---

# Mint a short-lived token for one website (from your server)

`POST /elements/v1/tokens`

## Request

- Base URL: `https://api.companystack.co.uk`
- URL: `https://api.companystack.co.uk/elements/v1/tokens`
- Auth: HTTP bearer

Call from your server with your secret key, then put the token in the page (the component's `token` attribute). The token works only from `origin`, only for `scopes` (suggest, select, display, identity) and, when given, only for `company_numbers`, for `ttl_seconds` (30 to 900, default 600). Revoking the secret key stops its tokens at once. Minting is free; requests made with the token count against your plan as the secret key's would. At most 600 tokens a minute per key.

## Request body

- object
  - `origin` string, required: The exact website the page is on (no wildcard)
  - `scopes` string[], required
  - `company_numbers` string[]: Limit the token to these companies (leave out for any)
  - `ttl_seconds` integer
  - `end_user` string: An opaque id for the visitor, so the per-visitor limits apply to them (never an email address or name)

## Response `201`

The token

- object
  - `token` string
  - `expires_at` string
  - `origin` string
  - `scopes` string[]
  - `company_numbers` string[], nullable

## Other responses

- `400`: An invalid origin, scope, company number, lifetime or visitor id
- `401`: No secret key, or an invalid one
- `403`: Sent from a browser (`secret_key_in_browser`), or with a publishable key (`secret_key_required`)
- `429`: Too many tokens minted in a minute

---

[API](https://skmtc.dev/companystack/apis/companystack-api.md) · [All operations](https://skmtc.dev/companystack/apis/companystack-api/llms.txt) · [OpenAPI document](https://skmtc.dev/companystack/apis/companystack-api/revisions/8f3234237d2d?raw)