---
title: "Exchange an API key for a short-lived access token"
method: POST
path: "/tokens"
tags: ["Auth"]
---

# Exchange an API key for a short-lived access token

`POST /tokens`

## Request

- Base URL: `https://sitecurl.com/api/v1`
- URL: `https://sitecurl.com/api/v1/tokens`
- Auth: HTTP bearer

Trades a long-lived API key (sc_live_...) for a short-lived bearer token (sc_tok_...) valid for one hour. Intended for automated clients: keep the long-lived key in a secret manager and send only the expiring token on each request. The access token carries exactly the same account scope and rate limit as the key that minted it.

Access tokens cannot mint further access tokens (403), so a leaked token cannot renew itself past its expiry. Revoking the parent key immediately invalidates every token it issued, rather than leaving them valid until they expire. Individual tokens cannot be revoked on their own; revoking the parent key is the only lever.

Minting consumes one request from the account's hourly API rate limit.

## Response `201`

A new access token

- object
  - `access_token` string: Bearer token, prefixed sc_tok_
  - `token_type` 'Bearer'
  - `expires_in` integer: Seconds until the token expires (3600)

## Other responses

- `401`: Invalid or missing API key
- `403`: Either the account's plan does not include API access (error_code PLAN_REQUIRED), or the request authenticated with a short-lived access token rather than a long-lived API key (error_code LONG_LIVED_KEY_REQUIRED).
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/sitecurl/apis/sitecurl-api.md) · [All operations](https://skmtc.dev/sitecurl/apis/sitecurl-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sitecurl/apis/sitecurl-api/revisions/ca01cf5ff61c?raw)