---
title: "Mint a bounded client token"
method: POST
path: "/v1/client-tokens"
tags: ["WebRTC"]
---

# Mint a bounded client token

`POST /v1/client-tokens`

## Request

- Base URL: `https://api.revdesk.com`
- URL: `https://api.revdesk.com/v1/client-tokens`
- Auth: HTTP bearer

Issues a short-lived, downscoped token (rdc_…) that is safe to ship into an untrusted client app. The token is restricted to the from_numbers (caller IDs) and to_numbers (destinations) you specify, so it can only place calls within those bounds — never from any number to any number. Present it on the same Authorization: Bearer header in place of your API key; the WebRTC SDK accepts it directly. The token's bounds must fall within this key's own number allowlist and its scopes; it is stateless and revoked by expiry. This endpoint requires a real API key — a minted token cannot mint further tokens. Regardless of the parent key's scopes, a client token may only carry the browser-calling scope (voice:webrtc) — it can never make durable account changes or mint further tokens. An explicit, non-empty to_numbers (destination allowlist) is required so the token can never dial an arbitrary number.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `from_numbers` string[], required
  - `to_numbers` string[], required
  - `scopes` string[]
  - `ttl_seconds` integer

## Response `200`

Success

- object
  - `data` object, required
    - `token` string, required
    - `expires_in` number, required
    - `from_numbers` string[], required
    - `to_numbers` string[], required
    - `scopes` string[], required

## Other responses

- `400`: Validation error
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `409`: Conflict (incl. idempotency conflicts)
- `429`: Rate limited

---

[API](https://skmtc.dev/revdesk/apis/revdesk-v1-api.md) · [All operations](https://skmtc.dev/revdesk/apis/revdesk-v1-api/llms.txt) · [OpenAPI document](https://skmtc.dev/revdesk/apis/revdesk-v1-api/revisions/fcbd43530a48?raw)