Realtime
The Realtime endpoints.
Auth: API key · Base URL:
https://api.mailkite.dev
Endpoints
Each row expands to its request and response schema. The address bar follows along, so any endpoint can be linked to directly.
POST /v1/realtime/token Mint a short-lived, single-use token that authorises one Realtime API connection. For browsers: EventSource cannot set headers, so this is what a page passes as ?token= instead of putting an API key in a URL. Inherits the calling credential's scope, expires in five minutes, and burns on first use. The stream itself is GET /v1/realtime — a subscription, not a request/response call, so it is contracted in sdks/spec/realtime.json rather than here.
Mint a short-lived, single-use token that authorises one Realtime API connection. For browsers: EventSource cannot set headers, so this is what a page passes as ?token= instead of putting an API key in a URL. Inherits the calling credential's scope, expires in five minutes, and burns on first use. The stream itself is GET /v1/realtime — a subscription, not a request/response call, so it is contracted in sdks/spec/realtime.json rather than here.
Response body
realtime-token-response.jsonPart of the Realtime API (sdks/spec/realtime.json). A short-lived, single-use token that authorises exactly one Realtime connection. Exists because EventSource cannot set headers: without it a browser would have to put a long-lived API key in a query string, where proxies log it and browser history keeps it. Inherits the scope of the credential that minted it and can never exceed it.
| Field | Type | Notes |
|---|---|---|
| token req | string | The value to pass as ?token= on the Realtime connection. Burns on first use. |
| expiresAt req | integer | When the token stops being accepted, in Unix epoch milliseconds (UTC). |
| expiresAtIso req | string (ISO 8601) | The same instant as an ISO 8601 string. |
An actual response, recorded from the conformance suite.
{
"token": "mk_rt_eyJ1c2VySWQiOiJ1c3JfN0ZqM01uUXcifQ.9f2c1b7d4e",
"expiresAt": 1769731500000,
"expiresAtIso": "2026-01-30T00:05:00.000Z"
}{
"$schema": "http://json-schema.org/draft-07/schema#",
"$id": "https://api.mailkite.dev/v1/schemas/realtime-token-response.json",
"title": "Realtime token response",
"description": "Part of the Realtime API (sdks/spec/realtime.json). A short-lived, single-use token that authorises exactly one Realtime connection. Exists because EventSource cannot set headers: without it a browser would have to put a long-lived API key in a query string, where proxies log it and browser history keeps it. Inherits the scope of the credential that minted it and can never exceed it.",
"type": "object",
"required": [
"token",
"expiresAt",
"expiresAtIso"
],
"properties": {
"token": {
"type": "string",
"description": "The value to pass as ?token= on the Realtime connection. Burns on first use.",
"examples": [
"mk_rt_9Fq2LmXc4vBn8Hs1"
]
},
"expiresAt": {
"type": "integer",
"description": "When the token stops being accepted, in Unix epoch milliseconds (UTC).",
"examples": [
1769731500000
]
},
"expiresAtIso": {
"type": "string",
"format": "date-time",
"description": "The same instant as an ISO 8601 string.",
"examples": [
"2026-01-30T00:05:00.000Z"
]
}
}
}