Create a short-lived JWT

posthttps://pyth.dourolabs.app/auth/token

An API key, in an Authorization: Bearer <API_KEY> header. An access token cannot create another token.

Creates a short-lived access token, a JWT, from an API key. Servers send the API key directly. Use this endpoint only to give a browser or other untrusted client a short-lived token, so the API key stays on the server: a server calls this endpoint and passes the token to the client.

The Hermes-compatible API does not accept access tokens.

post/auth/token

curl "https://pyth.dourolabs.app/auth/token" \
  -H "Authorization: Bearer $PYTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJ9.c2ln",
  "expires_at": "2026-01-01T00:00:00Z",
  "token_type": "Bearer"
}

Request body

application/json

Send a JSON object with these fields.

ttl_secondsinteger | nullOptional

Requested token lifetime, in seconds. The server caps it at its maximum lifetime, and uses the maximum when this field is omitted.

Response

200 · application/json

Returns a JSON object with the following fields.

access_tokenstring

The access token. For REST requests, send it in the Authorization: Bearer <access_token> header.

expires_atstring

Token expiration time as an RFC 3339 date-time string in UTC.

token_typestring

The authentication scheme for this token. Always Bearer.

Errors

Status codes returned when a request fails.

400: The Authorization header does not contain a correctly formatted bearer token.
401: Authentication is missing, the API key is invalid, or the request carries an access token instead of an API key.
404: Access token creation is unavailable on this deployment.