---
title: "Mint an ephemeral browser-safe client token (pvct_)"
method: POST
path: "/v1/client_tokens"
tags: ["client_tokens"]
---

# Mint an ephemeral browser-safe client token (pvct_)

`POST /v1/client_tokens`

## Request

- Base URL: `https://api.primateintelligence.ai`
- URL: `https://api.primateintelligence.ai/v1/client_tokens`
- Auth: none declared

Server-side token exchange (§4.9): authenticate with a secret key (or first-party session), receive a short-lived scoped pvct_ bearer for the browser. The browser then calls Primate directly — your secret key never leaves your server. Tokens are revoked implicitly when the minting key is revoked (≤5s). Rate class: 120/min per key. Client tokens can never mint tokens.

## Request body

- CreateClientTokenRequest
  - `scopes` string[], required: Non-empty subset of the §4.9 scope set. Must also be a subset of the minting key’s scopes.
  - `ttl_s` integer: Token lifetime in seconds (60–900, default 900). Tokens are never refreshable — mint a new one.
  - `video_id` string: Optional resource binding: narrows the token to this one video. Mutually exclusive with stream_id.
  - `stream_id` string: Optional resource binding to one stream (WS acceptance ships P6).

## Response `201`

Token minted. The raw token appears only in this response.

- ClientToken
  - `object` 'client_token', required
  - `id` string, required
  - `token` string, required: 256-bit CSPRNG bearer, SHA-256 at rest — shown exactly once. Browser-safe: accepted on product-plane endpoints (CORS *).
  - `scopes` string[], required
  - `expires_at` string, required
  - `video_id` string: Video resource id (prefixed ULID). Immutable.
  - `stream_id` string

## Other responses

- `400`: validation_failed — scopes/ttl_s/binding violations, all listed at once.
- `403`: insufficient_scope — requested scopes exceed the minting key’s, or the caller is itself a client token.
- `404`: resource_not_found — video_id binding does not resolve to an owned video.
- `429`: rate_limit_exceeded — client_tokens.create is 120/min per key.

---

[API](https://skmtc.dev/primateintelligence/apis/primate-vision-api.md) · [All operations](https://skmtc.dev/primateintelligence/apis/primate-vision-api/llms.txt) · [OpenAPI document](https://skmtc.dev/primateintelligence/apis/primate-vision-api/revisions/aa51b01dc8ad?raw)