> ## Documentation Index
> Fetch the complete documentation index at: https://aspect.inc/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Asset Token

> Get a fresh per-asset token for storage operations (upload and download).

Resolves the user's effective permissions on the asset and maps them to a
permissions claim in the JWT.

User is required, since all token usage scenarios require it:
- Uploading assets (web/desktop, in the init route)
- Uploading chunks/manifests (fs, can only mount as user)
- Downloading chunks/manifests (fs, can only mount as user)

Note: Single-file downloads directly use WorkOS tokens, since the worker calls /downloads/info might as well auth then.
      Fetching tokens separately still requires worker download info request, and both this & passing download info from client -> worker defeats purpose of single url download.

Returns 403 if the user has no read or write permissions.



## OpenAPI

````yaml /api-reference/openapi.json post /assets/{asset_id}/token
openapi: 3.1.0
info:
  title: Aspect Platform API
  description: A FastAPI application for Aspect Platform functionality
  version: 0.0.0
servers:
  - url: https://api.aspect.inc
security:
  - BearerAuth: []
  - ApiKeyAuth: []
paths:
  /assets/{asset_id}/token:
    post:
      tags:
        - Assets
      summary: Get Asset Token
      description: >-
        Get a fresh per-asset token for storage operations (upload and
        download).


        Resolves the user's effective permissions on the asset and maps them to
        a

        permissions claim in the JWT.


        User is required, since all token usage scenarios require it:

        - Uploading assets (web/desktop, in the init route)

        - Uploading chunks/manifests (fs, can only mount as user)

        - Downloading chunks/manifests (fs, can only mount as user)


        Note: Single-file downloads directly use WorkOS tokens, since the worker
        calls /downloads/info might as well auth then.
              Fetching tokens separately still requires worker download info request, and both this & passing download info from client -> worker defeats purpose of single url download.

        Returns 403 if the user has no read or write permissions.
      operationId: post_Assets_assets_asset_id_token
      parameters:
        - name: asset_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Asset ID
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AssetTokenResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    AssetTokenResponse:
      properties:
        asset_id:
          type: string
          format: uuid
          title: Asset Id
          description: Asset ID the token is scoped to
        token:
          type: string
          title: Token
          description: >-
            Signed RS256 JWT authorizing storage operations through the edge
            worker
        token_expires_at:
          type: string
          format: date-time
          title: Token Expires At
          description: When the token expires
      type: object
      required:
        - asset_id
        - token
        - token_expires_at
      title: AssetTokenResponse
      description: API response schema for fetching a per-asset edge worker token
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT in Authorization header. 'Bearer ' prefix optional.
    ApiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Aspect API key (sk_...) in Authorization header. 'Bearer ' optional.

````