Create a session token
Exchanges an API key for a short-lived JWT. Mint tokens on your server and hand them to
clients, so the API key never leaves your server. Send the key as
Authorization: Bearer rk_.... A JWT cannot mint another token; it is rejected with 401.
Every token is session-scoped. It can call /sessions, the routes under
/sessions/{session_id}, and /clips, for the sessions it created or was bound to.
Most other routes reject it with 403. POST /tokens and POST /files reject it with 401.
An empty body mints a token for all models your key can use, with up to 5 sessions. Send
authorization_details to narrow it to named models, to bind sessions that already exist,
or to cap the number of sessions and how long each one may run.
A token lasts 1 hour by default. expires_after sets a shorter or longer lifetime, up to
6 hours. A token never outlives the API key it was minted from; read expires_at for the
expiry actually issued.
Each POST /sessions made with the token adds the new session to the token’s bound set.
Closed sessions still count toward max_sessions, so the limit applies over the token’s
whole lifetime, not to concurrent sessions.
Authorizations
A Reactor API key (rk_...), sent as Authorization: Bearer rk_.... Keep it on a server.
Headers
The API protocol version the client speaks. Currently 1. Older versions than the server's minimum get 426.
"1"
The lowest API version the client accepts. A value above the server's version returns 501.
"1"
Body
Optional. Omit it, or send {}, for the default all-models scope and a 1-hour lifetime.
The token lifetime in seconds. Defaults to 3600 (1 hour) when omitted, zero, or
negative. Values above 21600 (6 hours) are capped. The token also never outlives the
API key's own expiry.
900
What the token may do. Send exactly one entry. Omit the field for all models and up to
5 sessions. An empty array or null is rejected.
1 elementResponse
A token was issued.
The session token. Send it as Authorization: Bearer <jwt> to /sessions and
/clips.
When the token expires, in Unix seconds.
1784375400
The grant as issued, in canonical form: models resolved and sorted, bound sessions
sorted and deduplicated. constraints.max_sessions is present only when you set it or
bound sessions; otherwise the default of 5 applies.