> ## Documentation Index
> Fetch the complete documentation index at: https://docs.voicemark.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokens

> Ephemeral JWTs issued on voice match. 60-second TTL.

A VoiceMark **token** is the credential. When a voice matches the enrolled voiceprint, `/v1/verify` returns a JWT the caller passes to their backend. The backend validates it at `/v1/token/{id}/validate` before authorising any privileged action.

## Lifecycle

1. `/v1/verify` returns `{ token, token_id, authorized: true, expires_in: 60 }`
2. Client passes `token` to your backend (via header, not URL)
3. Backend calls `/v1/token/{token_id}/validate?token={jwt}` server-side
4. `{ valid: true, expires_in: 44 }` → proceed; `{ valid: false }` → reject

## Security properties

* **60-second TTL** — short window limits replay exposure
* **Never store tokens** — they are single-use credentials, not session keys
* **Validate server-side** — do not trust the client's `authorized` flag for high-value actions
* **No PII in the JWT** — the token identifies the transaction, not the speaker

## Passing tokens safely

```typescript theme={null}
// Good — header auth
await fetch("/api/payment", {
  headers: { "X-VoiceMark-Token": verify.token },
});

// Bad — never put tokens in URLs
await fetch(`/api/payment?token=${verify.token}`); // logs, caches, referer headers
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.