---
title: "Create Client Token"
method: POST
path: "/v1/client/tokens"
---

# Create Client Token

`POST /v1/client/tokens`

Create an ephemeral API token for client sessions.

## Headers

- `x-api-key` string, required — API key for authentication

## Request body

- ClientTokenRequest
  - `expiresIn` integer, nullable — Seconds until the token expires (default 60)
  - `allowedModels` string[], nullable — Restrict which models this token can access (max 20)
  - `allowedOrigins` string[], nullable — Restrict which web origins this token can be used from (max 20)
  - `constraints` TokenConstraints
    - `realtime` RealtimeConstraints
      - `maxSessionDuration` integer, nullable
  - `metadata` object, nullable

## Response `200`

Successful Response

- ClientTokenResponse
  - `apiKey` string, required
  - `expiresAt` string, required
  - `permissions` object, nullable
  - `constraints` object, nullable

## Other responses

- `401` — No or invalid API key provided
- `403` — Cannot create client token from a client token
- `422` — Validation Error

---

[API](https://skmtc.net/decart/apis/decart-api.md) · [All operations](https://skmtc.net/decart/apis/decart-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/decart/decart-api/versions/3f568c124e81/schema)