Enterprise API authentication

Keep long-lived enterprise credentials on your server and mint short-lived client tokens.

Send exactly one supported credential per request.

Server-to-server requests

Keep the provisioned API key in your server’s secret manager and pass it in X-API-Key. A normal server request should not send an Origin header; if it does, the origin must be allowed for that key.

Client applications

Never ship the long-lived key to a client. Your trusted server should mint a short-lived token and return only that token to the authenticated application.

curl --request POST \
  --url https://api.monologue.to/v1/enterprise/client-tokens \
  --header "Content-Type: application/json" \
  --header "X-API-Key: $MONOLOGUE_ENTERPRISE_API_KEY" \
  --data '{
    "origin": "https://app.example.com",
    "client_user_id": "user_123",
    "client_session_id": "session_456",
    "ttl_seconds": 60
  }'

{
  "client_token": "mlg_ent_client_...",
  "expires_at": "2026-07-20T10:31:00Z"
}

Tokens default to 60 seconds and are capped at 120 seconds. Bind each token to an exact browser origin or a stable native client_app_id. When a browser sends the request, its actual Origin header must match the token.