> ## Documentation Index
> Fetch the complete documentation index at: https://docs.overshoot.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create viewer token

> Issue a short-lived, subscribe-only LiveKit token so the stream owner can watch the exact video feed the model is ingesting.

## What it's for

Watching your own stream — a monitoring dashboard, a debug view, or any UI that should show the video the model sees. The token is subscribe-only: it cannot publish media or data-channel messages, so it is safe to hand to a display-only client.

Only the stream owner can request one; other API keys get a `404`.

## How to use it

Connect with any LiveKit client SDK and render the remote video track:

```ts theme={null}
import { Room } from 'livekit-client';

const { view } = await createViewerToken(streamId);
const room = new Room();
await room.connect(view.url, view.token);
room.on('trackSubscribed', (track) => track.attach(videoElement));
```

Tokens expire after `view.expires_in_seconds` (currently 300). A connected session survives token expiry, but reconnecting after expiry requires a fresh token — request a new one from this endpoint.


## OpenAPI

````yaml POST /streams/{stream_id}/viewer-token
openapi: 3.0.3
info:
  title: Overshoot API
  version: 1.0.0-beta
  description: >
    Real-time video understanding API. Create a live video stream, push frames
    over

    WebRTC (LiveKit), then ask a vision-language model questions about what's
    happening

    using an OpenAI-compatible chat completions endpoint.


    Billing endpoints are mounted on the same host under `/billing`.
servers:
  - url: https://api.overshoot.ai/v1beta
security:
  - bearerAuth: []
tags:
  - name: Streams
    description: Create, inspect, keep alive, and delete live video streams.
  - name: Models
    description: List available vision-language models.
  - name: Chat
    description: Ask models questions about a stream's frames.
  - name: Billing
    description: Pricing, prepaid balance, and checkout.
paths:
  /streams/{stream_id}/viewer-token:
    parameters:
      - $ref: '#/components/parameters/StreamId'
      - $ref: '#/components/parameters/RegionHeader'
    post:
      tags:
        - Streams
      summary: Create viewer token
      description: >
        Issues a short-lived, subscribe-only LiveKit token so the stream owner
        can watch

        the video the model is ingesting. The token cannot publish media or
        data-channel

        messages. Connect with any LiveKit client SDK and render the remote
        video track.
      operationId: createViewerToken
      responses:
        '200':
          description: Viewer token issued.
          headers:
            X-Overshoot-Region:
              $ref: '#/components/headers/RegionResponseHeader'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ViewerTokenResponse'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Stream unknown, expired, deleted, or owned by a different user.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Wrong region.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegionError'
components:
  parameters:
    StreamId:
      name: stream_id
      in: path
      required: true
      schema:
        type: string
        format: uuid
      description: UUID returned by `POST /streams`.
    RegionHeader:
      name: X-Overshoot-Region
      in: header
      required: false
      schema:
        type: string
        enum:
          - us-west1
          - us-central1
      description: >
        Optional hint to route the request to the region that owns the stream.
        If the

        request reaches the wrong region the API returns `409` with a
        `region_error` body.
  headers:
    RegionResponseHeader:
      description: The region that served this request.
      schema:
        type: string
        enum:
          - us-west1
          - us-central1
  schemas:
    ViewerTokenResponse:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The stream identifier the token was issued for.
        view:
          $ref: '#/components/schemas/ViewInfo'
      required:
        - id
        - view
    Error:
      type: object
      description: Standard error body used by stream-lifecycle and billing endpoints.
      properties:
        detail:
          type: string
      required:
        - detail
    RegionError:
      type: object
      description: Returned on `409` when the request reaches the wrong region.
      properties:
        detail:
          type: object
          properties:
            error:
              type: string
              example: region_error
            expected_region:
              type: string
              example: us-west1
            requested_region:
              type: string
              nullable: true
              example: us-central1
    ViewInfo:
      type: object
      description: >-
        WebRTC view target. Connect with the LiveKit client SDK and subscribe to
        the remote video track.
      properties:
        type:
          type: string
          enum:
            - livekit
          default: livekit
        url:
          type: string
          description: LiveKit room URL (`wss://...`).
        token:
          type: string
          description: >-
            Short-lived subscribe-only JWT. Cannot publish media or data-channel
            messages.
        expires_in_seconds:
          type: integer
          example: 300
          description: Seconds until the token expires. Request a new one when it does.
      required:
        - type
        - url
        - token
        - expires_in_seconds
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API key (e.g. `ovs_...`)
      description: >
        Every public HTTP request requires `Authorization: Bearer <api_key>`,
        except

        `GET /models` and the public `/billing/pricing` endpoints.


        - `401` means the key is missing, unknown, or revoked.

        - `403` means the key is valid but cannot access the requested resource.

        - The publish token returned by `POST /streams` is only for publishing
        media to
          LiveKit. It does not replace the API key for HTTP calls.

````