---
title: "Create a short-lived token"
method: POST
path: "/access/v2/tokens/short-lived"
tags: ["Tokens"]
---

# Create a short-lived token

`POST /access/v2/tokens/short-lived`

Exchange a valid user access token for a short-lived JWT with minimal scopes. This endpoint is suitable for scenarios where a long-lived or broad-scope token is inappropriate. A typical use case is authenticating WebSocket connections, where the token may be passed via query parameters.

## Response `201`

A response containing a short-lived JWT and its lifetime

## Other responses

- `400` — The request failed due to a client error, with one or more of the following possible causes: 1. The request required a tenant_id field, which was missing. 2. The request was malformed syntactically or semantically.
- `401` — Authentication Error
- `403` — Forbidden Error
- `422` — Validation Error
- `500` — An unexpected error occurred preventing the operation from being performed.

## Changes

- **2026-03-26** `464f061f1cc4` — 2 info
  - media type `application/json` was changed to `application/json; charset=utf-8` for the response status `401`
  - the `detail` response's property default value changed from `Failed to authenticate` to `Forbidden operation` for the status `403`
- **2026-03-06** `74c4012c9a70` — 1 breaking, 3 info
  - removed the success response with the status `200`
  - added the non-success response with the status `401`
  - added the non-success response with the status `422`
  - added the success response with the status `201`
- **2026-03-02** `44d8f6d30587` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/hiddenlayerai/apis/hiddenlayer-audit-api/changes/access/v2/tokens/short-lived/post.md)

---

[API](https://skmtc.dev/hiddenlayerai/apis/hiddenlayer-audit-api.md) · [All operations](https://skmtc.dev/hiddenlayerai/apis/hiddenlayer-audit-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hiddenlayerai/apis/hiddenlayer-audit-api/revisions/a455e8bd59e0?raw)