API reference
Create realtime token
Short-lived WebSocket token.
POST
/realtime/tokensShort-lived (5 minute) token for wss://…/ws?token=. Works with publishable keys, so browsers never hold a secret key.
- Permission
- write:realtime
- Auth
- api-key
- Idempotent
- No
- Language
- Node.js
| Field | In | Type | Required | Description |
|---|---|---|---|---|
| invoiceId | body | string | No | Restrict the token to one invoice. Recommended for browsers. |
const response = await fetch(`${process.env.BOSPAY_API_BASE}/realtime/tokens`, {
method: "POST",
headers: {
"Content-Type": "application/json",
"BOSPay-Version": "2026-09-23",
"X-API-Key": process.env.BOSPAY_API_KEY,
},
body: JSON.stringify({
"invoiceId": "inv_1048"
})
});
if (!response.ok) {
throw new Error(`BOSPay request failed: ${response.status}`);
}
const data = await response.json();Success
201
{
"object": "realtime_token",
"token": "rt_…",
"expiresAt": "2026-09-23T10:47:00.000Z",
"invoiceId": "inv_1048",
"url": "/ws?token=rt_…"
}Validation error
400
{
"error": {
"type": "invalid_request_error",
"code": "validation_error",
"message": "A valid fiatAmount is required.",
"field": "fiatAmount",
"requestId": "req_3f0c9a1b2c4d5e6f7a8b9c0d"
}
}