> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withheadlight.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Token minting

# Token minting

`POST /api/v1/embed/chart-sessions`

## Auth

Bearer API key with `embed:chart` permission. Session cookie auth is not supported for this route.

## Request

```json theme={null}
{ "frameOrigin": "https://your-app.example.com" }
```

`frameOrigin` must exactly match an entry in `EMBED_ALLOWED_FRAME_ORIGINS` (bare origin, no trailing slash).

## Response

```json theme={null}
{ "token": "...", "expiresInSeconds": 300 }
```

Tokens are Ed25519 JWTs with `kid` in the header. Public keys ship in the pinned embed bundle.

## What the token is for

Metering and licensing. Framing is enforced by CSP `frame-ancestors`, which the browser applies regardless of client-side verification.