Exchange an API key for a short-lived media token

Exchange your permanent API key for a short-lived token that authenticates /stream/ requests without any header, so native players (AVPlayer, ExoPlayer) can fetch media directly.

Call this from your server, never from the device — the point of the exchange is that your permanent key never ships inside an app binary.

Usage: append the token to any stream URL as a query parameter:

GET /stream/videos/branded/squat.mp4?token=<token>

Scope: the token is valid on /stream/ paths only. It cannot read /exercises, /routines, or any other endpoint, and it cannot mint another token.

Metering: each /stream/ request authenticated by a token counts against the originating key's quota exactly as a keyed request does. Revoking the key, or losing the subscription, invalidates every outstanding token immediately.

Tier: requires TESTING or above. BASIC is Playground-only.

Rate limit: this is a refresh endpoint, not a per-video call. Mint one token per session and reuse it until it expires.

{
  "expires_in": 900,
  "token": "eyJleHAiOjE3NTQzNDU2MDAsImlhdCI6MTc1NDM0NDcwMH0.c2lnbmF0dXJl"
}