Ephemeral AI Sessions
POST
/v1/ai/{project_id}/sessionEliminates API key exposure on mobile and SPA frontends by issuing bounded capability tokens.
#
Minting
Mint Headers & Body
| Header | Required | Value |
|---|---|---|
apikey | yes | Service role key or authenticated user JWT |
Content-Type | yes | application/json |
The minting endpoint checks and reserves token budgets against the project's real monthly quota and caches the resolved provider pipeline for 300 seconds.
#
Invocation
Strict Capability Authentication
Attention
Endpoints /session/chat, /session/chat/stream, and /session/embed strictly mandate Authorization: Bearer <ticket>. Supplying standard apikey headers is rejected to prevent confusion between permanent keys and ephemeral session capabilities.
v1.0 · revised Oct 31, 2026