Short-lived tokens

Tokens are small, time-boxed credentials you hand to Shen.AI (CE) instead of a permanent API key.

Property	Description
Format	`sh_<32 hex chars>`
Carry	License and usage limits needed to initialize the SDK
TTL	60 - 86 400 seconds (default 3600 s)
Scope	Only allows initializing the SDK

Why prefer tokens?

Leak resistance - a captured token expires quickly, while your permanent key stays on your backend.
Granular limits - set max_measurements or single_device.
Server-side control - issue tokens only when your backend has authorized the current user/session.

Endpoints

Method	Path	Purpose
`POST`	`/v1/token`	Create one token
`POST`	`/v1/tokens`	Create many tokens, up to 1000 in one call

Both require the tokens:generate scope.

Request body

Field	Type	Required	Notes
`license_id`	int	No	Omit to use the first active license
`expires_in`	int	No	60 - 86 400 seconds, default 3600
`max_measurements`	int	No	Hard cap per token
`single_device`	bool	No	Lock to the first device

Remote Configuration fields are intentionally omitted here because Remote Configuration is not available in Shen.AI (CE).

See the OpenAPI reference for the exact schema.

Quick example


curl -X POST https://api.shen.ai/v1/token \
  -H "Authorization: Bearer $SHENAI_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expires_in":3600,"single_device":true}'

Response


{
  "token": "sh_b71ef965c4c4468b9eab8c646f6f6d16",
  "expires_at": "2025-07-15T12:00:00Z"
}

Using the token in the SDK

Pass the token exactly where you would pass the permanent API key.


shenaiSDK.initialize("sh_b71ef965c4c4468b9eab8c646f6f6d16")


shenaiSDKHandler.initialize(this, "sh_b71ef965c4c4468b9eab8c646f6f6d16")

No other code changes are needed.

Best practices

Do	Why
Store the Admin Credential in an environment variable	Never check secrets into git
Use `single_device: true` whenever feasible	Prevents token sharing across devices
Keep TTL short for browser-based flows	Limits the impact of a leak
Use longer TTLs for mobile apps that need offline usage after first activation	Lets the SDK continue when the device temporarily has no network

Tokens cannot currently be revoked individually. Design for short TTLs or rotate the Admin Credential if immediate revocation is needed.