Get an access token

Mint an 8-hour access token from the visitor's 2-year identity token (or a new visitor).

Call again when the access token expires or a request returns 401. host_origin is the origin of the website the chat runs on. It must be an http(s) origin on the organization's allowed_domains (exact host or subdomain), else 403; the browser's Origin header must be the widget frame origin. The access token remembers host_origin; WS tickets are refused once that domain is removed. A valid identity token for this organization returns the same customer and the same identity token (its expiry does not slide); a missing, unknown, expired or other-organization one mints a new customer and identity token. Rate limits: 10/min per IP, plus the 300/min per-IP limit of every /customer route.

POST/v1/customer/token

Get an access token

curl -X POST 'https://app.staging.mlive.chat/v1/customer/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "organization_id": "8cc7b1ee-a0e4-7910-8500-c032c91d4754",
    "host_origin": "https://shop.northwind.example"
  }'

const res = await fetch('https://app.staging.mlive.chat/v1/customer/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "organization_id": "8cc7b1ee-a0e4-7910-8500-c032c91d4754",
    "host_origin": "https://shop.northwind.example"
  }),
});
const data = await res.json();

Response200

{
  "token": "mlcc_8Jb3kQ2xV9",
  "expires_at": "2026-11-13T17:30:00Z",
  "identity_token": "mlcv_Q7nZ4pL1sT",
  "identity_expires_at": "2028-11-12T09:30:00Z",
  "customer_id": "8c60d6b9-574a-79f8-8233-5d37ed1ca076"
}

Specifics

Method URL	`POST https://app.staging.mlive.chat/v1/customer/token`
Who can call it	Anyone. No token needed.
Rate limit	10/min per IP, plus the 300/min per-IP limit of every `/customer` route.

Request body

application/json

organization_idstring (uuid)required
host_originstring (uri)required
tokenstring or null
The stored identity token (mlcv_…), if any.

Response

200 · application/json

OK.

tokenstringrequired
Access token mlcc_…, 8 hours; send as Authorization: Bearer.
expires_atstring (date-time)required
identity_tokenstringrequired
identity_expires_atstring (date-time)required
customer_idstring (uuid)required

Errors

400 validation: The request is malformed or a field is invalid. Unknown fields are refused too.
403 forbidden: This caller may not do this.
404 not_found: Not found, or not visible to this caller. A record in another organization is always not found.
429 rate_limited: Too many requests. Wait the number of seconds in the Retry-After header.