Mint an access token from your server

When you need it

Public and shared lists need only a publishable key. A private list also needs a short-lived access token on every query. Your backend mints one after your user signs in, and your front end sends it to the runtime as Authorization: Bearer … alongside the publishable key.

Before you call it

• Issue a secret key from Dashboard → Applications. It is shown once and stored only as a digest. Put it in your server’s secret manager, never in browser or mobile code.
• The token is minted for the secret key’s application, so query with a publishable key issued under that same application.
• Every list you name must be one your workspace owns or holds an active subscription to.

Request

POST /api/v1/token on the control plane, with the secret key in the Authorization header and one to twenty list ids in the body.

curl -X POST https://staging.app.autosugges.com/api/v1/token \
  -H "Authorization: Bearer $AUTOSUGGES_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"listIds": ["YOUR_PRIVATE_LIST_ID"]}'

Response

{
  "accessToken": "eyJraWQiOi…",
  "tokenType": "Bearer",
  "expiresIn": 3600,
  "expiresAt": 1790000000,
  "applicationId": "YOUR_APPLICATION_ID",
  "listIds": ["YOUR_PRIVATE_LIST_ID"],
  "scope": ["query", "list:YOUR_PRIVATE_LIST_ID"],
  "requestId": "…"
}

The token lives one hour. Mint a new one before it expires; there is no refresh token. Hand the browser the access token only — never the secret key.

Errors

• 401 invalid_key — the secret key is missing, unknown or revoked, or its application is disabled.
• 404 invalid_list — a list is not yours and you hold no active subscription to it.
• 400 invalid_request — the body is malformed; details.fields names each field.
• 503 internal_error with details.reason: token_minting_unavailable — token minting is not configured in this environment. Retry later.

Revoking a secret key

Revoking stops new tokens immediately. Tokens it already minted keep working until they expire, at most one hour later.