Mint a realtime handoff token

A short-lived credential for opening the realtime WebSocket from a context that shouldn’t hold the API key. Send {"data": {"token": "..."}} as the first WebSocket message before it expires; the connection then behaves exactly like an API-key connection (channels come from the key’s scopes at connect time, and the connection outlives the token). Daemons that hold the key can skip this endpoint and connect with {"data": {"apiKey": "..."}} directly. Requires a key with at least one realtime-capable scope. Guide: https://docs.tippage.com/api/realtime

POST/realtime/token

Authorization

AuthorizationBearer token (tp_live_... or tpat_...) · headerrequired

A TipPage API key (`tp_live_...`, created in Dashboard → Settings → Developer) or an OAuth 2.0 access token (`tpat_...`, see the OAuth guide). Both carry the same scopes and are accepted on every endpoint.

Request body

application/json

expires_ininteger

Token lifetime in seconds (how long it can be used to connect).

min 60 · max 3600 · default: 900

groupsstring[]

Narrow the token to a subset of the key's groups - so a broad key can hand out a token that only sees some of them. Every name must be a group the key's own scopes already grant (otherwise 403 `group_not_granted`); it can only narrow, never widen. Omit to grant everything the key allows.

Responses

200Connection details.

urlstring

The raw WebSocket endpoint - no client library needed.

tokenstring

Send as `{"data": {"token": "..."}}` in the first WebSocket message.

expires_atstring<date-time>

channelsstring[]

The channels this token will actually grant (the key's scopes, narrowed by `groups` if given).

400`groups` was malformed or contained an unknown group name (`bad_groups`).

errorstringrequired

Human-readable message.

codestring

Machine-readable code (e.g. `missing_scope`, `not_in_queue`).

401Missing or invalid credential (`missing_api_key` / `invalid_api_key`, or `invalid_token` for an expired/revoked OAuth access token).

errorstringrequired

Human-readable message.

codestring

Machine-readable code (e.g. `missing_scope`, `not_in_queue`).

403The key has no realtime-capable scopes (`no_realtime_scopes`), or `groups` asked for one the key doesn't grant (`group_not_granted`).

errorstringrequired

Human-readable message.

codestring

Machine-readable code (e.g. `missing_scope`, `not_in_queue`).

429Rate limit exceeded - check the `RateLimit-*` headers.

errorstring

Request

curl -X POST "https://api.tippage.com/v1/realtime/token" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "expires_in": 900,
  "groups": [
    "tts",
    "twitch"
  ]
}'

const response = await fetch("https://api.tippage.com/v1/realtime/token", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "expires_in": 900,
  "groups": [
    "tts",
    "twitch"
  ]
})
});

import requests

response = requests.post(
    "https://api.tippage.com/v1/realtime/token",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    json={
  "expires_in": 900,
  "groups": [
    "tts",
    "twitch"
  ]
},
)

Response

{
  "url": "wss://ws.tippage.com",
  "token": "string",
  "expires_at": "2019-08-24T14:15:22Z",
  "channels": [
    "dev:t_abc123:tts",
    "dev:t_abc123:twitch"
  ]
}