API keys and session tokens

// On your server: an endpoint your page or app calls to get a session token
// for a Nuance Live conversation.
// A web-standard handler, so it runs as a Next.js route handler, on Bun,
// Deno or a Cloudflare Worker as written.

const NUANCE_API = process.env.NUANCE_API_URL ?? "https://api.nuancelabs.ai";

/**
 * Your id for the signed-in person making the request, or null. Replace this
 * with your own auth (NextAuth, Clerk, your session cookie): anyone who can
 * call this endpoint can start conversations on your account. Until then it
 * signs in no one, unless you set EXAMPLE_USER_ID to try the example.
 */
async function currentUserId(_request: Request): Promise<string | null> {
  return process.env.EXAMPLE_USER_ID ?? null;
}

export async function POST(request: Request): Promise<Response> {
  const userId = await currentUserId(request);
  if (!userId) {
    return new Response("Sign in to start a conversation", { status: 401 });
  }

  const response = await fetch(`${NUANCE_API}/session-tokens`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.NUANCE_API_KEY}`,
      "Content-Type": "application/json",
    },
    // Your id for the person, so a policy pause stops them, not your whole
    // account. Letters, digits and _ . : - only: hash an email first.
    body: JSON.stringify({ end_user_id: userId }),
  });
  if (!response.ok) {
    // For you, in your server's log: the status and Nuance's reason, such as
    // 401 for a wrong or revoked key. The page gets only the generic message.
    console.error(
      `POST /session-tokens answered ${response.status}: ${await response.text()}`,
    );
    return new Response("Couldn't start a conversation", { status: 502 });
  }

  const { token } = (await response.json()) as { token: string };
  return Response.json({ token });
}