Exchange an API key for a short-lived access token

Trades a long-lived API key (sc_live_...) for a short-lived bearer token (sc_tok_...) valid for one hour. Intended for automated clients: keep the long-lived key in a secret manager and send only the expiring token on each request. The access token carries exactly the same account scope and rate limit as the key that minted it.

Access tokens cannot mint further access tokens (403), so a leaked token cannot renew itself past its expiry. Revoking the parent key immediately invalidates every token it issued, rather than leaving them valid until they expire. Individual tokens cannot be revoked on their own; revoking the parent key is the only lever.

Minting consumes one request from the account's hourly API rate limit.