> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chatzy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Access Token

Securely generate short-lived `access_token` and long-lived `refresh_token` for authorized iframe access.

> ⚠️ **Important**: This endpoint **must be called from your server**, not from the client side. The `client_api_key` is sensitive and should never be exposed on the client side.

Once you obtain the tokens, pass the `access_token` to the client-side where the iframe will be embedded.

### Embed URL for Iframe

Use the following format to embed the iframe securely:

```http theme={null}
https://app.chatzy.ai/chatbot-iframe/{chatbot_id}?user_id=<USER_ID>&access_token=<ACCESS_TOKEN>
```

Chatzy AI will validate the token from query params for every API call made within the iframe, ensuring the user is authorized to access the AI Agent.

**⚠️ Important**

* Ensure tokens are stored securely, as refresh token will be used to retrieve a new access token when the **old one expires**.
* **Refresh token logic is explained in the next API endpoint: `/ai-agent/refresh_token`.**
* Never expose the `client_api_key` on the frontend.


## OpenAPI

````yaml post /ai_agent/get_access_token
openapi: 3.0.0
info:
  title: Chatzy AI API
  version: 1.0.0
  description: >-
    Chatzy AI REST API for messaging, contact conversations, and agent
    interactions.
  contact:
    name: Chatzy
    url: https://chatzy.ai
    email: support@chatzy.ai
servers:
  - url: https://vevdoh3hve.execute-api.us-east-1.amazonaws.com/prod
    description: Production Server
security: []
tags:
  - name: Authentication
    description: Authentication to access the API
  - name: Contact Conversations
    description: Get contact conversations
  - name: Conversational AI Agent Interactions
    description: Interact with the conversational AI agent
  - name: Authorized iframe Access
    description: APIs for authorized iframe access
paths:
  /ai_agent/get_access_token:
    post:
      tags:
        - Authorized iframe Access
      summary: Get Access Token
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - user_id
                - chatbot_id
                - client_api_key
              properties:
                user_id:
                  type: string
                  example: user123 // client's customer id
                chatbot_id:
                  type: string
                  format: uuid
                  example: 8a1e3f18-991b-4a2e-9973-f53e7fc94ff1
                client_api_key:
                  type: string
                  description: >-
                    AI Agent Auth Key - Can be retrieved from
                    https://app.chatzy.ai/profile
                  example: ak-xxxxxxxxxxx
      responses:
        '200':
          description: Access and refresh token response
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      access_token:
                        type: string
                        description: JWT access token
                      refresh_token:
                        type: string
                        description: JWT refresh token
                      access_token_expires_at:
                        type: integer
                        description: Unix timestamp (ms) when access token expires
                        example: 1753453415000
                      refresh_token_expires_at:
                        type: integer
                        description: Unix timestamp (ms) when refresh token expires
                        example: 1754057315000
                    required:
                      - access_token
                      - refresh_token
                      - access_token_expires_in
                      - refresh_token_expires_in

````