telnyx 7.29.0 → 7.30.0-beta.0

package/resources/telephony-credentials.d.ts

@@ -2,6 +2,7 @@ import { APIResource } from "../core/resource.js";
 import { APIPromise } from "../core/api-promise.js";
 import { DefaultFlatPagination, type DefaultFlatPaginationParams, PagePromise } from "../core/pagination.js";
 import { RequestOptions } from "../internal/request-options.js";
+import { type LoginTokenOptions, type TokenMaterial } from "../lib/login-token.js";
 export declare class TelephonyCredentials extends APIResource {
     /**
      * Returns a paginated list of the on-demand telephony credentials on your account,
@@ -28,7 +29,7 @@ export declare class TelephonyCredentials extends APIResource {
      *   });
      * ```
      */
-    create(body: TelephonyCredentialCreateParams, options?: RequestOptions): APIPromise<TelephonyCredentialCreateResponse>;
+    create(params: TelephonyCredentialCreateParams, options?: RequestOptions): APIPromise<TelephonyCredentialCreateResponse>;
     /**
      * Permanently deletes the specified telephony credential, revoking any access it
      * provided.
@@ -60,6 +61,37 @@ export declare class TelephonyCredentials extends APIResource {
      * ```
      */
     update(id: string, body: TelephonyCredentialUpdateParams, options?: RequestOptions): APIPromise<TelephonyCredentialUpdateResponse>;
+    /**
+     * The material a login token is signed with (`kid`, `tel_token`,
+     * `signing_secret`), for a credential that did not come from `create`. Treat
+     * the result like the SIP password.
+     *
+     * @example
+     * ```ts
+     * const { data: tokenMaterial } =
+     *   await client.telephonyCredentials.retrieveTokenMaterial('id');
+     * ```
+     */
+    retrieveTokenMaterial(id: string, options?: RequestOptions): APIPromise<TelephonyCredentialRetrieveTokenMaterialResponse>;
+    /**
+     * Mints a WebRTC login token for the credential locally: the same use as
+     * `createToken`, with no request to Telnyx per token. Uses the
+     * `token_material` of a credential from `create`, or `tokenMaterial` from the
+     * options, or fetches it once with `retrieveTokenMaterial`.
+     *
+     * `ttl` is the token lifetime in seconds, 1..86400, default one hour.
+     *
+     * @example
+     * ```ts
+     * const { data: credential } = await client.telephonyCredentials.create({
+     *   connection_id: '1234567890',
+     * });
+     * const loginToken = await client.telephonyCredentials.toJwt(credential);
+     * ```
+     */
+    toJwt(credential: TelephonyCredential, options?: LoginTokenOptions & {
+        requestOptions?: RequestOptions | undefined;
+    }): Promise<string>;
     /**
      * Create an Access Token (JWT) for the credential.
      *
@@ -114,6 +146,14 @@ export interface TelephonyCredential {
      * Identifies the user this credential is associated with.
      */
     user_id?: string;
+    /**
+     * What a login token is signed with. Returned by `create`; see `toJwt` and
+     * `retrieveTokenMaterial`.
+     */
+    token_material?: TokenMaterial;
+}
+export interface TelephonyCredentialRetrieveTokenMaterialResponse {
+    data?: TokenMaterial;
 }
 export interface TelephonyCredentialCreateResponse {
     data?: TelephonyCredential;
@@ -164,6 +204,11 @@ export declare namespace TelephonyCredentialListParams {
     }
 }
 export interface TelephonyCredentialCreateParams {
+    /**
+     * Query param: extra fields to return. `token_material` adds what `toJwt` signs
+     * with (as sensitive as `sip_password`; keep it on the server).
+     */
+    include?: 'token_material' | undefined;
     /**
      * Identifies the Credential Connection this credential is associated with.
      */
@@ -202,7 +247,8 @@ export interface TelephonyCredentialCreateTokenParams {
      */
     'Idempotency-Key'?: string;
 }
+export type { LoginTokenOptions, TokenMaterial } from "../lib/login-token.js";
 export declare namespace TelephonyCredentials {
-    export { type TelephonyCredential as TelephonyCredential, type TelephonyCredentialCreateResponse as TelephonyCredentialCreateResponse, type TelephonyCredentialRetrieveResponse as TelephonyCredentialRetrieveResponse, type TelephonyCredentialUpdateResponse as TelephonyCredentialUpdateResponse, type TelephonyCredentialDeleteResponse as TelephonyCredentialDeleteResponse, type TelephonyCredentialCreateTokenResponse as TelephonyCredentialCreateTokenResponse, type TelephonyCredentialsDefaultFlatPagination as TelephonyCredentialsDefaultFlatPagination, type TelephonyCredentialListParams as TelephonyCredentialListParams, type TelephonyCredentialCreateParams as TelephonyCredentialCreateParams, type TelephonyCredentialUpdateParams as TelephonyCredentialUpdateParams, type TelephonyCredentialCreateTokenParams as TelephonyCredentialCreateTokenParams, };
+    export { type TelephonyCredential as TelephonyCredential, type TelephonyCredentialCreateResponse as TelephonyCredentialCreateResponse, type TelephonyCredentialRetrieveResponse as TelephonyCredentialRetrieveResponse, type TelephonyCredentialUpdateResponse as TelephonyCredentialUpdateResponse, type TelephonyCredentialDeleteResponse as TelephonyCredentialDeleteResponse, type TelephonyCredentialCreateTokenResponse as TelephonyCredentialCreateTokenResponse, type TelephonyCredentialRetrieveTokenMaterialResponse as TelephonyCredentialRetrieveTokenMaterialResponse, type TokenMaterial as TokenMaterial, type TelephonyCredentialsDefaultFlatPagination as TelephonyCredentialsDefaultFlatPagination, type TelephonyCredentialListParams as TelephonyCredentialListParams, type TelephonyCredentialCreateParams as TelephonyCredentialCreateParams, type TelephonyCredentialUpdateParams as TelephonyCredentialUpdateParams, type TelephonyCredentialCreateTokenParams as TelephonyCredentialCreateTokenParams, };
 }
 //# sourceMappingURL=telephony-credentials.d.ts.map

package/resources/telephony-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telephony-credentials.d.ts","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,4BAAyB;AAC/C,OAAO,EAAE,UAAU,EAAE,+BAA4B;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,WAAW,EAAE,8BAA2B;AAE1G,OAAO,EAAE,cAAc,EAAE,uCAAoC;AAG7D,qBAAa,oBAAqB,SAAQ,WAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,KAAK,GAAE,6BAA6B,GAAG,IAAI,GAAG,SAAc,EAC5D,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,yCAAyC,EAAE,mBAAmB,CAAC;IAO9E;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,IAAI,EAAE,+BAA+B,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAIhD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,iCAAiC,CAAC;IAI3F;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,mCAAmC,CAAC;IAI/F;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,+BAA+B,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAIhD;;;;;;;;OAQG;IACH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,oCAAoC,GAAG,IAAI,GAAG,SAAc,EACpE,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,MAAM,CAAC;CAatB;AAED,MAAM,MAAM,yCAAyC,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,sCAAsC,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,6BAA8B,SAAQ,2BAA2B;IAChF;;;OAGG;IACH,MAAM,CAAC,EAAE,6BAA6B,CAAC,MAAM,CAAC;CAC/C;AAED,yBAAiB,6BAA6B,CAAC;IAC7C;;;OAGG;IACH,UAAiB,MAAM;QACrB;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QAEtB;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd;CACF;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oCAAoC;IACnD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,OAAO,EACL,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,sCAAsC,IAAI,sCAAsC,EACrF,KAAK,yCAAyC,IAAI,yCAAyC,EAC3F,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,oCAAoC,IAAI,oCAAoC,GAClF,CAAC;CACH"}
+{"version":3,"file":"telephony-credentials.d.ts","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,4BAAyB;AAC/C,OAAO,EAAE,UAAU,EAAE,+BAA4B;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,2BAA2B,EAAE,WAAW,EAAE,8BAA2B;AAE1G,OAAO,EAAE,cAAc,EAAE,uCAAoC;AAE7D,OAAO,EAAoB,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,8BAA2B;AAElG,qBAAa,oBAAqB,SAAQ,WAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,KAAK,GAAE,6BAA6B,GAAG,IAAI,GAAG,SAAc,EAC5D,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,yCAAyC,EAAE,mBAAmB,CAAC;IAO9E;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,MAAM,EAAE,+BAA+B,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAUhD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,iCAAiC,CAAC;IAI3F;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,mCAAmC,CAAC;IAI/F;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,+BAA+B,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,iCAAiC,CAAC;IAIhD;;;;;;;;;;OAUG;IACH,qBAAqB,CACnB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,gDAAgD,CAAC;IAI/D;;;;;;;;;;;;;;;OAeG;IACG,KAAK,CACT,UAAU,EAAE,mBAAmB,EAC/B,OAAO,CAAC,EAAE,iBAAiB,GAAG;QAAE,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;KAAE,GAC5E,OAAO,CAAC,MAAM,CAAC;IASlB;;;;;;;;OAQG;IACH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,MAAM,GAAE,oCAAoC,GAAG,IAAI,GAAG,SAAc,EACpE,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,MAAM,CAAC;CAatB;AAED,MAAM,MAAM,yCAAyC,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;AAEnG,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,gDAAgD;IAC/D,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,sCAAsC,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,6BAA8B,SAAQ,2BAA2B;IAChF;;;OAGG;IACH,MAAM,CAAC,EAAE,6BAA6B,CAAC,MAAM,CAAC;CAC/C;AAED,yBAAiB,6BAA6B,CAAC;IAC7C;;;OAGG;IACH,UAAiB,MAAM;QACrB;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QAEtB;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,GAAG,CAAC,EAAE,MAAM,CAAC;KACd;CACF;AAED,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEvC;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,+BAA+B;IAC9C;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oCAAoC;IACnD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,8BAA2B;AAE3E,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,OAAO,EACL,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,sCAAsC,IAAI,sCAAsC,EACrF,KAAK,gDAAgD,IAAI,gDAAgD,EACzG,KAAK,aAAa,IAAI,aAAa,EACnC,KAAK,yCAAyC,IAAI,yCAAyC,EAC3F,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,oCAAoC,IAAI,oCAAoC,GAClF,CAAC;CACH"}

package/resources/telephony-credentials.js

@@ -6,6 +6,7 @@ const resource_1 = require("../core/resource.js");
 const pagination_1 = require("../core/pagination.js");
 const headers_1 = require("../internal/headers.js");
 const path_1 = require("../internal/utils/path.js");
+const login_token_1 = require("../lib/login-token.js");
 class TelephonyCredentials extends resource_1.APIResource {
     /**
      * Returns a paginated list of the on-demand telephony credentials on your account,
@@ -37,8 +38,14 @@ class TelephonyCredentials extends resource_1.APIResource {
      *   });
      * ```
      */
-    create(body, options) {
-        return this._client.post('/telephony_credentials', { body, ...options });
+    create(params, options) {
+        // `include` is a query parameter; everything else is the body.
+        const { include, ...body } = params;
+        return this._client.post('/telephony_credentials', {
+            ...(include === undefined ? {} : { query: { include } }),
+            body,
+            ...options,
+        });
     }
     /**
      * Permanently deletes the specified telephony credential, revoking any access it
@@ -77,6 +84,43 @@ class TelephonyCredentials extends resource_1.APIResource {
     update(id, body, options) {
         return this._client.patch((0, path_1.path) `/telephony_credentials/${id}`, { body, ...options });
     }
+    /**
+     * The material a login token is signed with (`kid`, `tel_token`,
+     * `signing_secret`), for a credential that did not come from `create`. Treat
+     * the result like the SIP password.
+     *
+     * @example
+     * ```ts
+     * const { data: tokenMaterial } =
+     *   await client.telephonyCredentials.retrieveTokenMaterial('id');
+     * ```
+     */
+    retrieveTokenMaterial(id, options) {
+        return this._client.get((0, path_1.path) `/telephony_credentials/${id}/token_material`, options);
+    }
+    /**
+     * Mints a WebRTC login token for the credential locally: the same use as
+     * `createToken`, with no request to Telnyx per token. Uses the
+     * `token_material` of a credential from `create`, or `tokenMaterial` from the
+     * options, or fetches it once with `retrieveTokenMaterial`.
+     *
+     * `ttl` is the token lifetime in seconds, 1..86400, default one hour.
+     *
+     * @example
+     * ```ts
+     * const { data: credential } = await client.telephonyCredentials.create({
+     *   connection_id: '1234567890',
+     * });
+     * const loginToken = await client.telephonyCredentials.toJwt(credential);
+     * ```
+     */
+    async toJwt(credential, options) {
+        const { requestOptions, ...tokenOptions } = options ?? {};
+        const tokenMaterial = tokenOptions.tokenMaterial ??
+            credential.token_material ??
+            (await this.retrieveTokenMaterial(credential.id ?? '', requestOptions)).data;
+        return (0, login_token_1.createLoginToken)(credential, { ...tokenOptions, tokenMaterial });
+    }
     /**
      * Create an Access Token (JWT) for the credential.
      *

package/resources/telephony-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"telephony-credentials.js","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,kDAA+C;AAE/C,sDAA0G;AAC1G,oDAAmD;AAEnD,oDAA8C;AAE9C,MAAa,oBAAqB,SAAQ,sBAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,QAA0D,EAAE,EAC5D,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAA,kCAA0C,CAAA,EAAE;YACnG,KAAK;YACL,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAU,EAAE,OAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAU,EACV,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,EAAU,EACV,SAAkE,EAAE,EACpE,OAAwB;QAExB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,QAAQ,EAAE;YACjE,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB;oBACE,MAAM,EAAE,YAAY;oBACpB,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAChF;gBACD,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF;AAhHD,oDAgHC"}
+{"version":3,"file":"telephony-credentials.js","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,kDAA+C;AAE/C,sDAA0G;AAC1G,oDAAmD;AAEnD,oDAA8C;AAC9C,uDAAkG;AAElG,MAAa,oBAAqB,SAAQ,sBAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,QAA0D,EAAE,EAC5D,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAA,kCAA0C,CAAA,EAAE;YACnG,KAAK;YACL,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,MAAuC,EACvC,OAAwB;QAExB,+DAA+D;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI;YACJ,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAU,EAAE,OAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAU,EACV,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;OAUG;IACH,qBAAqB,CACnB,EAAU,EACV,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,KAAK,CACT,UAA+B,EAC/B,OAA6E;QAE7E,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAC1D,MAAM,aAAa,GACjB,YAAY,CAAC,aAAa;YAC1B,UAAU,CAAC,cAAc;YACzB,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,OAAO,IAAA,8BAAgB,EAAC,UAAU,EAAE,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,EAAU,EACV,SAAkE,EAAE,EACpE,OAAwB;QAExB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAA,WAAI,EAAA,0BAA0B,EAAE,QAAQ,EAAE;YACjE,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB;oBACE,MAAM,EAAE,YAAY;oBACpB,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAChF;gBACD,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF;AApKD,oDAoKC"}

package/resources/telephony-credentials.mjs

@@ -3,6 +3,7 @@ import { APIResource } from "../core/resource.mjs";
 import { DefaultFlatPagination } from "../core/pagination.mjs";
 import { buildHeaders } from "../internal/headers.mjs";
 import { path } from "../internal/utils/path.mjs";
+import { createLoginToken } from "../lib/login-token.mjs";
 export class TelephonyCredentials extends APIResource {
     /**
      * Returns a paginated list of the on-demand telephony credentials on your account,
@@ -34,8 +35,14 @@ export class TelephonyCredentials extends APIResource {
      *   });
      * ```
      */
-    create(body, options) {
-        return this._client.post('/telephony_credentials', { body, ...options });
+    create(params, options) {
+        // `include` is a query parameter; everything else is the body.
+        const { include, ...body } = params;
+        return this._client.post('/telephony_credentials', {
+            ...(include === undefined ? {} : { query: { include } }),
+            body,
+            ...options,
+        });
     }
     /**
      * Permanently deletes the specified telephony credential, revoking any access it
@@ -74,6 +81,43 @@ export class TelephonyCredentials extends APIResource {
     update(id, body, options) {
         return this._client.patch(path `/telephony_credentials/${id}`, { body, ...options });
     }
+    /**
+     * The material a login token is signed with (`kid`, `tel_token`,
+     * `signing_secret`), for a credential that did not come from `create`. Treat
+     * the result like the SIP password.
+     *
+     * @example
+     * ```ts
+     * const { data: tokenMaterial } =
+     *   await client.telephonyCredentials.retrieveTokenMaterial('id');
+     * ```
+     */
+    retrieveTokenMaterial(id, options) {
+        return this._client.get(path `/telephony_credentials/${id}/token_material`, options);
+    }
+    /**
+     * Mints a WebRTC login token for the credential locally: the same use as
+     * `createToken`, with no request to Telnyx per token. Uses the
+     * `token_material` of a credential from `create`, or `tokenMaterial` from the
+     * options, or fetches it once with `retrieveTokenMaterial`.
+     *
+     * `ttl` is the token lifetime in seconds, 1..86400, default one hour.
+     *
+     * @example
+     * ```ts
+     * const { data: credential } = await client.telephonyCredentials.create({
+     *   connection_id: '1234567890',
+     * });
+     * const loginToken = await client.telephonyCredentials.toJwt(credential);
+     * ```
+     */
+    async toJwt(credential, options) {
+        const { requestOptions, ...tokenOptions } = options ?? {};
+        const tokenMaterial = tokenOptions.tokenMaterial ??
+            credential.token_material ??
+            (await this.retrieveTokenMaterial(credential.id ?? '', requestOptions)).data;
+        return createLoginToken(credential, { ...tokenOptions, tokenMaterial });
+    }
     /**
      * Create an Access Token (JWT) for the credential.
      *

package/resources/telephony-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"telephony-credentials.mjs","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAE/C,OAAO,EAAE,qBAAqB,EAAiD,+BAA2B;AAC1G,OAAO,EAAE,YAAY,EAAE,gCAA4B;AAEnD,OAAO,EAAE,IAAI,EAAE,mCAA+B;AAE9C,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,QAA0D,EAAE,EAC5D,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAA,qBAA0C,CAAA,EAAE;YACnG,KAAK;YACL,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAU,EAAE,OAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAU,EACV,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAA,0BAA0B,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,EAAU,EACV,SAAkE,EAAE,EACpE,OAAwB;QAExB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAA,0BAA0B,EAAE,QAAQ,EAAE;YACjE,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB;oBACE,MAAM,EAAE,YAAY;oBACpB,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAChF;gBACD,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"telephony-credentials.mjs","sourceRoot":"","sources":["../src/resources/telephony-credentials.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,6BAAyB;AAE/C,OAAO,EAAE,qBAAqB,EAAiD,+BAA2B;AAC1G,OAAO,EAAE,YAAY,EAAE,gCAA4B;AAEnD,OAAO,EAAE,IAAI,EAAE,mCAA+B;AAC9C,OAAO,EAAE,gBAAgB,EAA8C,+BAA2B;AAElG,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IACnD;;;;;;;;;;;OAWG;IACH,IAAI,CACF,QAA0D,EAAE,EAC5D,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAA,qBAA0C,CAAA,EAAE;YACnG,KAAK;YACL,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,MAAuC,EACvC,OAAwB;QAExB,+DAA+D;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI;YACJ,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAU,EAAE,OAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CACJ,EAAU,EACV,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAA,0BAA0B,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;OAUG;IACH,qBAAqB,CACnB,EAAU,EACV,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,0BAA0B,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,KAAK,CACT,UAA+B,EAC/B,OAA6E;QAE7E,MAAM,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAC1D,MAAM,aAAa,GACjB,YAAY,CAAC,aAAa;YAC1B,UAAU,CAAC,cAAc;YACzB,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,OAAO,gBAAgB,CAAC,UAAU,EAAE,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,EAAU,EACV,SAAkE,EAAE,EACpE,OAAwB;QAExB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAA,0BAA0B,EAAE,QAAQ,EAAE;YACjE,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB;oBACE,MAAM,EAAE,YAAY;oBACpB,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAChF;gBACD,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF"}

package/src/client.ts

@@ -966,10 +966,12 @@ import {
   TelephonyCredentialDeleteResponse,
   TelephonyCredentialListParams,
   TelephonyCredentialRetrieveResponse,
+  TelephonyCredentialRetrieveTokenMaterialResponse,
   TelephonyCredentialUpdateParams,
   TelephonyCredentialUpdateResponse,
   TelephonyCredentials,
   TelephonyCredentialsDefaultFlatPagination,
+  TokenMaterial,
 } from './resources/telephony-credentials';
 import {
   TexmlApplication,
@@ -5142,6 +5144,8 @@ export declare namespace Telnyx {
     type TelephonyCredentialUpdateResponse as TelephonyCredentialUpdateResponse,
     type TelephonyCredentialDeleteResponse as TelephonyCredentialDeleteResponse,
     type TelephonyCredentialCreateTokenResponse as TelephonyCredentialCreateTokenResponse,
+    type TelephonyCredentialRetrieveTokenMaterialResponse as TelephonyCredentialRetrieveTokenMaterialResponse,
+    type TokenMaterial as TokenMaterial,
     type TelephonyCredentialsDefaultFlatPagination as TelephonyCredentialsDefaultFlatPagination,
     type TelephonyCredentialListParams as TelephonyCredentialListParams,
     type TelephonyCredentialCreateParams as TelephonyCredentialCreateParams,

package/src/lib/login-token.ts

@@ -0,0 +1,219 @@
+/**
+ * WebRTC login tokens minted locally, with no request to Telnyx.
+ *
+ * The token has the same shape as the one
+ * `POST /v2/telephony_credentials/{id}/token` returns, so it is used the same
+ * way: pass it to the WebRTC SDK as `login_token`. Telnyx verifies it on login.
+ * It is the same computation as `TelephonyCredential#to_jwt` in telnyx-ruby.
+ *
+ * The signing material comes from the credential: `token_material` is in the
+ * response of `POST /v2/telephony_credentials` and of
+ * `GET /v2/telephony_credentials/{id}/token_material`. It is as sensitive as
+ * the SIP password, so keep it on the server; never ship it to a browser.
+ *
+ * @example
+ * const { data: credential } = await client.telephonyCredentials.create({
+ *   connection_id: '123',
+ *   include: 'token_material',   // the API returns the material only when asked
+ * });
+ * const loginToken = await client.telephonyCredentials.toJwt(credential);          // 1 hour
+ * const shortLived = await client.telephonyCredentials.toJwt(credential, { ttl: 600 });
+ *
+ * To mint later with no request at all, store these with the user the credential
+ * belongs to, server side: `id`, `user_id`, `sip_username`, `expires_at` and
+ * `token_material`. The token is built from all of them.
+ *
+ * @example From stored values, without a request at all
+ * import { createLoginToken } from 'telnyx/lib/login-token';
+ * const loginToken = await createLoginToken({
+ *   id: '...', user_id: '...', sip_username: 'gencred...', expires_at: '2027-01-01T00:00:00Z',
+ *   token_material: { kid: 'v1', tel_token: '...', signing_secret: '...' },
+ * });
+ */
+
+import { TelnyxError } from '../core/error';
+import { fromBase64, toBase64 } from '../internal/utils/base64';
+import { decodeUTF8, encodeUTF8 } from '../internal/utils/bytes';
+
+/** Token lifetime when `ttl` is not given: one hour. */
+export const LOGIN_TOKEN_DEFAULT_TTL = 3600;
+/** Longest lifetime a login token can have: one day, the same as API-minted tokens. */
+export const LOGIN_TOKEN_MAX_TTL = 86400;
+/** `cty` header of a locally minted token; voice-sdk-proxy selects the verification path by it. */
+export const LOGIN_TOKEN_CONTENT_TYPE = 'telnyx-webrtc;v=1';
+
+/**
+ * What the API returns as `token_material`. `signing_secret` is base64url
+ * (unpadded) bytes of the HS256 key; `tel_token` goes into the token as is.
+ */
+export interface TokenMaterial {
+  /** Which key the material was derived with (`v1` today). Goes in the JWT header. */
+  kid: string;
+  /** The SIP credential encrypted for the gateway, the same value `/token` puts in the `tel_token` claim. */
+  tel_token: string;
+  /** The HS256 key the token is signed with, base64url. */
+  signing_secret: string;
+}
+
+/** The fields of a telephony credential that a login token is built from. */
+export interface LoginTokenCredential {
+  /** The telephony credential `id`. */
+  id?: string | undefined;
+  /** The credential's `user_id`. */
+  user_id?: string | undefined;
+  /** The credential's `sip_username`; the token's `identity`. */
+  sip_username?: string | undefined;
+  /** The credential's `expires_at`, as the API returns it, or null. */
+  expires_at?: string | null | undefined;
+  /** `kid`, `tel_token`, `signing_secret`; present on a credential from `create`. */
+  token_material?: TokenMaterial | undefined;
+}
+
+export interface LoginTokenOptions {
+  /** Token lifetime in seconds, 1..86400. Default one hour. */
+  ttl?: number | undefined;
+  /** Signing material to use instead of `credential.token_material`. */
+  tokenMaterial?: TokenMaterial | undefined;
+  /** The token's issue time; defaults to now. */
+  now?: Date | number | undefined;
+}
+
+export class TelnyxLoginTokenError extends TelnyxError {
+  constructor(message: string) {
+    super(message);
+    this.name = 'TelnyxLoginTokenError';
+  }
+}
+
+/**
+ * Mints a login token for `credential`, valid from `now` for `ttl` seconds.
+ * Pure computation: HMAC-SHA256 over the token with `token_material.signing_secret`.
+ */
+export async function createLoginToken(
+  credential: LoginTokenCredential,
+  options: LoginTokenOptions = {},
+): Promise<string> {
+  const credentialId = required(credential.id, 'id');
+  const userId = required(credential.user_id, 'user_id');
+  const identity = required(credential.sip_username, 'sip_username');
+  const material = normalizeMaterial(options.tokenMaterial ?? credential.token_material);
+  const ttl = clampTtl(options.ttl);
+  const now = options.now === undefined ? Date.now() : Number(options.now);
+  const iat = Math.floor(now / 1000);
+
+  // Same field order as the Ruby SDK, so the two produce the same bytes.
+  const header = { alg: 'HS256', typ: 'JWT', cty: LOGIN_TOKEN_CONTENT_TYPE, kid: material.kid };
+  const payload = {
+    sub: credentialId,
+    user_id: userId,
+    identity,
+    cred_exp: credential.expires_at ?? null,
+    tel_token: material.tel_token,
+    iat,
+    nbf: iat,
+    exp: iat + ttl,
+    jti: `${credentialId}-${iat}`,
+  };
+
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+  return `${signingInput}.${base64url(await sign(signingInput, material.signing_secret))}`;
+}
+
+/**
+ * Checks a token minted by `createLoginToken` against `signingSecret` and
+ * returns its claims. For tests and debugging: Telnyx does the real
+ * verification on login.
+ */
+export async function decodeLoginToken(jwt: string, signingSecret: string): Promise<Record<string, unknown>> {
+  const [head, body, sig, ...rest] = String(jwt).split('.');
+  if (!head || !body || sig === undefined || rest.length) {
+    throw new TelnyxLoginTokenError('not a JWT');
+  }
+  const expected = await sign(`${head}.${body}`, signingSecret);
+  const given = fromBase64url(sig);
+  if (!bytesEqual(given, expected)) {
+    throw new TelnyxLoginTokenError('Signature is invalid and does not match the payload');
+  }
+  return JSON.parse(decodeUTF8(fromBase64url(body))) as Record<string, unknown>;
+}
+
+function required(value: string | null | undefined, name: string): string {
+  if (value === undefined || value === null || String(value) === '') {
+    throw new TelnyxLoginTokenError(`${name} is required to mint a token`);
+  }
+  return String(value);
+}
+
+function normalizeMaterial(material: TokenMaterial | null | undefined): TokenMaterial {
+  if (!material || typeof material !== 'object') {
+    throw new TelnyxLoginTokenError('token_material is required to mint a token');
+  }
+  const out = {} as Record<keyof TokenMaterial, string>;
+  for (const field of ['kid', 'tel_token', 'signing_secret'] as const) {
+    const value = material[field];
+    if (value === undefined || value === null || String(value) === '') {
+      throw new TelnyxLoginTokenError(`token_material.${field} is missing`);
+    }
+    out[field] = String(value);
+  }
+  return out;
+}
+
+function clampTtl(ttl: number | undefined): number {
+  const n = ttl === undefined ? LOGIN_TOKEN_DEFAULT_TTL : Math.trunc(Number(ttl));
+  if (!Number.isFinite(n)) return LOGIN_TOKEN_DEFAULT_TTL;
+  return Math.min(LOGIN_TOKEN_MAX_TTL, Math.max(1, n));
+}
+
+function base64url(data: string | Uint8Array): string {
+  // Base64 pads with at most two '=': a bounded match keeps this linear on any input.
+  return toBase64(data)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/={1,2}$/, '');
+}
+
+function fromBase64url(str: string): Uint8Array {
+  const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
+  return fromBase64(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+}
+
+function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;
+  return diff === 0;
+}
+
+// HMAC-SHA256 through WebCrypto, which Node, Deno, Bun, browsers and edge runtimes all provide.
+interface SubtleCryptoLike {
+  importKey(
+    format: string,
+    keyData: Uint8Array,
+    algorithm: { name: string; hash: string },
+    extractable: boolean,
+    keyUsages: string[],
+  ): Promise<unknown>;
+  sign(algorithm: string, key: unknown, data: Uint8Array): Promise<ArrayBuffer>;
+}
+
+async function getSubtle(): Promise<SubtleCryptoLike> {
+  if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {
+    return globalThis.crypto.subtle as unknown as SubtleCryptoLike;
+  }
+  // Node.js < 19 may need webcrypto from crypto module
+  const nodeCrypto = await import('crypto');
+  return (nodeCrypto.webcrypto as unknown as { subtle: SubtleCryptoLike }).subtle;
+}
+
+async function sign(signingInput: string, signingSecret: string): Promise<Uint8Array> {
+  const subtle = await getSubtle();
+  const key = await subtle.importKey(
+    'raw',
+    fromBase64url(signingSecret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  return new Uint8Array(await subtle.sign('HMAC', key, encodeUTF8(signingInput)));
+}

package/src/resources/telephony-credentials.ts

@@ -6,6 +6,7 @@ import { DefaultFlatPagination, type DefaultFlatPaginationParams, PagePromise }
 import { buildHeaders } from '../internal/headers';
 import { RequestOptions } from '../internal/request-options';
 import { path } from '../internal/utils/path';
+import { createLoginToken, type LoginTokenOptions, type TokenMaterial } from '../lib/login-token';
 
 export class TelephonyCredentials extends APIResource {
   /**
@@ -43,10 +44,16 @@ export class TelephonyCredentials extends APIResource {
    * ```
    */
   create(
-    body: TelephonyCredentialCreateParams,
+    params: TelephonyCredentialCreateParams,
     options?: RequestOptions,
   ): APIPromise<TelephonyCredentialCreateResponse> {
-    return this._client.post('/telephony_credentials', { body, ...options });
+    // `include` is a query parameter; everything else is the body.
+    const { include, ...body } = params;
+    return this._client.post('/telephony_credentials', {
+      ...(include === undefined ? {} : { query: { include } }),
+      body,
+      ...options,
+    });
   }
 
   /**
@@ -93,6 +100,52 @@ export class TelephonyCredentials extends APIResource {
     return this._client.patch(path`/telephony_credentials/${id}`, { body, ...options });
   }
 
+  /**
+   * The material a login token is signed with (`kid`, `tel_token`,
+   * `signing_secret`), for a credential that did not come from `create`. Treat
+   * the result like the SIP password.
+   *
+   * @example
+   * ```ts
+   * const { data: tokenMaterial } =
+   *   await client.telephonyCredentials.retrieveTokenMaterial('id');
+   * ```
+   */
+  retrieveTokenMaterial(
+    id: string,
+    options?: RequestOptions,
+  ): APIPromise<TelephonyCredentialRetrieveTokenMaterialResponse> {
+    return this._client.get(path`/telephony_credentials/${id}/token_material`, options);
+  }
+
+  /**
+   * Mints a WebRTC login token for the credential locally: the same use as
+   * `createToken`, with no request to Telnyx per token. Uses the
+   * `token_material` of a credential from `create`, or `tokenMaterial` from the
+   * options, or fetches it once with `retrieveTokenMaterial`.
+   *
+   * `ttl` is the token lifetime in seconds, 1..86400, default one hour.
+   *
+   * @example
+   * ```ts
+   * const { data: credential } = await client.telephonyCredentials.create({
+   *   connection_id: '1234567890',
+   * });
+   * const loginToken = await client.telephonyCredentials.toJwt(credential);
+   * ```
+   */
+  async toJwt(
+    credential: TelephonyCredential,
+    options?: LoginTokenOptions & { requestOptions?: RequestOptions | undefined },
+  ): Promise<string> {
+    const { requestOptions, ...tokenOptions } = options ?? {};
+    const tokenMaterial =
+      tokenOptions.tokenMaterial ??
+      credential.token_material ??
+      (await this.retrieveTokenMaterial(credential.id ?? '', requestOptions)).data;
+    return createLoginToken(credential, { ...tokenOptions, tokenMaterial });
+  }
+
   /**
    * Create an Access Token (JWT) for the credential.
    *
@@ -175,6 +228,16 @@ export interface TelephonyCredential {
    * Identifies the user this credential is associated with.
    */
   user_id?: string;
+
+  /**
+   * What a login token is signed with. Returned by `create`; see `toJwt` and
+   * `retrieveTokenMaterial`.
+   */
+  token_material?: TokenMaterial;
+}
+
+export interface TelephonyCredentialRetrieveTokenMaterialResponse {
+  data?: TokenMaterial;
 }
 
 export interface TelephonyCredentialCreateResponse {
@@ -237,6 +300,12 @@ export namespace TelephonyCredentialListParams {
 }
 
 export interface TelephonyCredentialCreateParams {
+  /**
+   * Query param: extra fields to return. `token_material` adds what `toJwt` signs
+   * with (as sensitive as `sip_password`; keep it on the server).
+   */
+  include?: 'token_material' | undefined;
+
   /**
    * Identifies the Credential Connection this credential is associated with.
    */
@@ -284,6 +353,8 @@ export interface TelephonyCredentialCreateTokenParams {
   'Idempotency-Key'?: string;
 }
 
+export type { LoginTokenOptions, TokenMaterial } from '../lib/login-token';
+
 export declare namespace TelephonyCredentials {
   export {
     type TelephonyCredential as TelephonyCredential,
@@ -292,6 +363,8 @@ export declare namespace TelephonyCredentials {
     type TelephonyCredentialUpdateResponse as TelephonyCredentialUpdateResponse,
     type TelephonyCredentialDeleteResponse as TelephonyCredentialDeleteResponse,
     type TelephonyCredentialCreateTokenResponse as TelephonyCredentialCreateTokenResponse,
+    type TelephonyCredentialRetrieveTokenMaterialResponse as TelephonyCredentialRetrieveTokenMaterialResponse,
+    type TokenMaterial as TokenMaterial,
     type TelephonyCredentialsDefaultFlatPagination as TelephonyCredentialsDefaultFlatPagination,
     type TelephonyCredentialListParams as TelephonyCredentialListParams,
     type TelephonyCredentialCreateParams as TelephonyCredentialCreateParams,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '7.29.0'; // x-release-please-version
+export const VERSION = '7.30.0-beta.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "7.29.0";
+export declare const VERSION = "7.30.0-beta.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.mts","sourceRoot":"","sources":["src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,WAAW,CAAC"}
+{"version":3,"file":"version.d.mts","sourceRoot":"","sources":["src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,kBAAkB,CAAC"}

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "7.29.0";
+export declare const VERSION = "7.30.0-beta.0";
 //# sourceMappingURL=version.d.ts.map

package/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,WAAW,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,kBAAkB,CAAC"}