> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moss.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Server token route

> Mint a Founding Agent session from your server so your API key never reaches the browser.

## Why a server route

Your API key must stay on the server. The browser calls your own route; your route calls Moss with the secret key and returns a short-lived session token to the browser. This keeps your `sk_...` key out of client bundles entirely.

<Warning>
  The API key is a server secret. Never ship it to the browser or commit it to client code.
</Warning>

## Create the route

The example below uses Next.js App Router. The same `createFoundingAgentSession` call works from any Node server.

```ts theme={null}
// app/api/moss-token/route.ts
import { createFoundingAgentSession } from "@moss-tools/founding-agent";

export async function POST() {
  const session = await createFoundingAgentSession({
    apiKey: process.env.MOSS_FA_API_KEY!,
  });
  return Response.json(session);
}
```

## Response

The route returns a JSON object with the following fields.

<ResponseField name="token" type="string">
  LiveKit access token for the browser to join the session.
</ResponseField>

<ResponseField name="serverUrl" type="string">
  LiveKit server URL to connect to.
</ResponseField>

<ResponseField name="roomName" type="string">
  The session's room name.
</ResponseField>

<ResponseField name="bookingNonce" type="string">
  Optional. One-time value used by the booking flow.
</ResponseField>

<Note>
  `createFoundingAgentSession` also accepts `serviceUrl` and `timeoutMs`. The defaults are correct for production, so you can omit them.
</Note>

## Next steps

<CardGroup cols={1}>
  <Card title="React components" icon="react" href="/docs/founding-agent/embed/react-components">
    Add the provider and voice bubble to your React app.
  </Card>
</CardGroup>