# Access Tokens

## Create short-lived access token

**post** `/v1/access_tokens`

Exchange a long-lived API key for a short-lived access token. Authenticate with your long-lived API key as the Bearer token; the response contains a new token that authenticates the same team until it expires. Short-lived access tokens cannot be used to create additional access tokens.

### Body Parameters

- `customer_session_id: optional string`

  Optional opaque session identifier to associate with the access token.

- `expires_in: optional number`

  Lifetime of the access token in seconds. Defaults to 3600 (1 hour). Minimum 300 (5 minutes), maximum 86400 (24 hours).

- `user_id: optional string`

  Optional user identifier to associate with the access token for attribution. Use the same canonical user ID string that you send in other SafetyKit API calls.

### Returns

- `access_token: string`

  Short-lived bearer token. Use it in the Authorization header exactly like a long-lived API key. It cannot be used to create additional access tokens.

- `expires_at: string`

  ISO 8601 timestamp at which the access token expires.

- `expires_in: number`

  Number of seconds until the access token expires.

- `token_type: "Bearer"`

  Token type. Always Bearer.

  - `"Bearer"`

### Example

```http
curl https://api.safetykit.com/v1/access_tokens \
    -X POST \
    -H "Authorization: Bearer $SAFETYKIT_API_KEY"
```

#### Response

```json
{
  "access_token": "sk_live_abc123...",
  "expires_at": "2026-01-01T01:00:00.000Z",
  "expires_in": 3600,
  "token_type": "Bearer"
}
```

## Domain Types

### Access Token Create Access Token Response

- `AccessTokenCreateAccessTokenResponse object { access_token, expires_at, expires_in, token_type }`

  Response containing the newly created short-lived access token.

  - `access_token: string`

    Short-lived bearer token. Use it in the Authorization header exactly like a long-lived API key. It cannot be used to create additional access tokens.

  - `expires_at: string`

    ISO 8601 timestamp at which the access token expires.

  - `expires_in: number`

    Number of seconds until the access token expires.

  - `token_type: "Bearer"`

    Token type. Always Bearer.

    - `"Bearer"`