client_tokens

Mint an ephemeral browser-safe client token (pvct_)

Server-side token exchange (§4.9): authenticate with a secret key (or first-party session), receive a short-lived scoped pvct_ bearer for the browser. The browser then calls Primate directly — your secret key never leaves your server. Tokens are revoked implicitly when the minting key is revoked (≤5s). Rate class: 120/min per key. Client tokens can never mint tokens.

post/v1/client_tokens

Request

  • Base URL: https://api.primateintelligence.ai
  • URL: https://api.primateintelligence.ai/v1/client_tokens
  • Auth: none declared

Request body

scopesstring[] required

Non-empty subset of the §4.9 scope set. Must also be a subset of the minting key’s scopes.

ttl_sinteger

Token lifetime in seconds (60–900, default 900). Tokens are never refreshable — mint a new one.

video_idstring

Optional resource binding: narrows the token to this one video. Mutually exclusive with stream_id.

stream_idstring

Optional resource binding to one stream (WS acceptance ships P6).

Example request

{
  "video_id": "video_01KX12XX3BNM688AWHX7406HCF"
}

Response

Token minted. The raw token appears only in this response.

object'client_token' required
idstring required
tokenstring required

256-bit CSPRNG bearer, SHA-256 at rest — shown exactly once. Browser-safe: accepted on product-plane endpoints (CORS *).

scopesstring[] required
expires_atstring required
video_idstring

Video resource id (prefixed ULID). Immutable.

stream_idstring

Example response

{
  "token": "pvct_…",
  "video_id": "video_01KX12XX3BNM688AWHX7406HCF"
}

Changes

No recorded changes to this operation across all 1 revision of this API.