Mint Stream Token

Mint a short-lived (5-minute) single-use stream token.

The portal calls this immediately before opening an EventSource — the token replaces the raw API key in the ?token= URL so the long-lived key never lands in proxy logs / browser history / Referer headers.

Requires the firehose entitlement (402 otherwise) — minting a token for a key that would be rejected at stream-open time is pure confusion for the caller, and the early gate lets the portal render the upgrade CTA before it even attempts an EventSource connection.