Skip to main content
POST
Mint an embed token

Authorizations

X-API-Key
string
header
required

API key obtained from the ClarityQ dashboard.

Path Parameters

product_id
string<uuid>
required

Body

application/json
email
string
required

The end user's email — this IS the identity. It becomes an ordinary ClarityQ user, owning that address's conversation history. Lower-cased before use. Send only addresses your application has authenticated.

Pattern: ^[^@\s]+@[^@\s]+\.[^@\s]+$
Example:

"jane@acme.com"

name
string

Display name. Falls back to the email.

Example:

"Jane Doe"

ttl_seconds
integer
default:3600

Token lifetime in seconds. Tokens cannot be revoked, so this is the exposure window if one leaks — prefer the shortest your refresh handling can live with. Below 300 the refresh warning leaves your server little time to mint a replacement.

Required range: 1 <= x <= 86400

Response

Successful Response

token
string
required

The embed JWT. Put it in the iframe URL fragment at boot, and in clarityq:token postMessages after that.

expires_in
integer
required

Lifetime in seconds (the ttl_seconds you sent, or 3600).