Reference · step 1 of 9

POST/generate-token

{{base_url}}/generate-token

Exchange the API key for a token that lives 4 hours (expires_in 14400). Every later call sends it as Authorization: Bearer <token>.

Headers

Content-Type

application/json

Keys and what they mean

Request

key	type	when present	importance	meaning
api_key	string	required	must read	Your API key (starts with aiqo_). Keep it on your server; never send it from a browser or app.
Total: 1 keys

key	type	when present	importance	meaning
token	string	always	must read	Send it as Authorization: Bearer <token> on every other call.
token_type	string	always	informational	Always Bearer.
expires_in	integer	always	must read	Seconds the token lives (14400 = 4 hours). Get a new token before it ends; a call with an expired token answers 401.
expires_at	datetime	always	useful	The same end as a time (UTC).
Total: 4 keys

Errors this call answers with (4)

HTTP	code	message	detail	when
401	9001	Authentication required	Invalid api_key	Unknown key, suspended user, or the API has no API-key routes (today). Observed on the local stack.
401	9001	Authentication required	Api_key required
400	5000	Invalid request	(Huma's text)	Malformed JSON or wrong content type.
429	9004	Too many requests		Rate limit, when configured.

Questions developers ask (2)

How long does a token last?: 4 hours (expires_in, expires_at). Renew before it ends; an expired token answers 401 with code 9001.
Can I call the API from a browser or a mobile app?: No. The API key must stay on your server; call the API from there.

Real captures of this call