Phone tokens

Short-lived tokens that let an end-user place a call from a browser or mobile softphone — your API key never reaches the client. See the Browser SDK token flow for the full picture.

POST/phone-tokens/mint

Mint a token for an end-user.

Field	Type	Required	Description
uuid	string	Required	The end-user's `uuid`.
ttl_seconds	integer, nullable	Optional	Token lifetime (server default if omitted).
max_concurrent	integer, nullable	Optional	Simultaneous calls this token allows.

Returns { token: string, phone_token: PhoneToken, iceServers: array }. The token and iceServers are what the Browser SDK's authenticate() takes directly.

# your backend — the secret key stays here
curl https://sauti-pbx.services.co.ke/api/phone-tokens/mint \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "uuid": "the-end-user-uuid" }'

// → 200 OK
{
  "token": "eyJhbGc...",
  "phone_token": { "uuid": "...", "expires_at": "..." },
  "iceServers": [ { "urls": "stun:..." } ]
}

// your backend — the secret key stays here
const res = await fetch('https://sauti-pbx.services.co.ke/api/phone-tokens/mint', {
  method: 'POST',
  headers: { 'Authorization': 'Bearer sk_live_...', 'Content-Type': 'application/json' },
  body: JSON.stringify({ uuid: 'the-end-user-uuid' }),
});
const { token, iceServers } = await res.json();
// hand only { token, iceServers } to the browser

# your backend — the secret key stays here
import requests

res = requests.post(
    'https://sauti-pbx.services.co.ke/api/phone-tokens/mint',
    headers={'Authorization': 'Bearer sk_live_...'},
    json={'uuid': 'the-end-user-uuid'},
)
data = res.json()
# hand only data['token'] / data['iceServers'] to the browser

POST/phone-tokens/revoke

Revoke a token immediately. Body { uuid: string } (the token's uuid). Returns { message: string }.

The PhoneToken object

Field	Type	Description
uuid	string	Token identifier (use with revoke).
end_user	string	The end-user's uuid.
extension_number	string	The end-user's extension.
max_concurrent	integer	Concurrent-call limit.
is_valid	boolean	Whether the token is still usable.
expires_at / revoked_at / created_at	string, nullable	ISO-8601 timestamps.