---
updatedAt: 2026-09-22T13:14:59.000Z
agentTools:
  projectIndex: https://docs.sumsub.com/llms.txt
---

# Authentication

All Sumsub API requests require authentication using an app token and a signed request signature. The app token identifies your integration, while the signature — generated with HMAC-SHA256 — ensures each request is tamper-proof and tied to a specific timestamp. Together, they are passed as HTTP headers on every call.

# Generate app token

An app token authenticates your requests to the Sumsub API. You can create one in the Dashboard — see [App Tokens](https://docs.sumsub.com/sumsub/docs/app-tokens) for instructions. For Web and Mobile SDK integrations, see [Generate Access Token](https://docs.sumsub.com/sumsub/reference/generate-access-token).

<Callout icon="📘" theme="info">
  ### Note

  The full-sized app token and secret key values are shown in the Dashboard only once — at the moment you create the token; make sure to save it to a secure location on your device. Once created, you will not be able to make any changes.
</Callout>

# Make requests

All requests must contain the following headers:

* `X-App-Token` — an app token that you generate in the Dashboard.
* `X-App-Access-Sig` — a request signature in the HEX format and lowercase.
* `X-App-Access-Ts` — a number of seconds since Unix Epoch in UTC.

<Callout icon="🚧" theme="warn">
  ### Attention

  All API requests must be sent over HTTPS; plain HTTP requests will be refused. You must include your `X-App-Token` header in all requests.
</Callout>

# Sign requests

The `X-App-Access-Sig` header value is an HMAC-SHA256 signature computed using your secret key (provided upon [app token generation](https://docs.sumsub.com/sumsub/docs/app-tokens)) over the concatenation of the following:

* The value of the `X-App-Access-Ts` header as a string.
* An HTTP method in uppercase, for example, `GET` or `POST`.
* The request URI, excluding the host, starting with a slash, and including all query parameters, for example, `/resources/applicants/123?fields=info`.
* The request body exactly as sent. Omit if there is no body, for example, for `GET` requests.

The following is an example of the string to be signed to get an access token:

```curl
1607551635POST/resources/accessTokens/sdk{"ttlInSecs": 600, "userId": "johndoeID", "levelName": "basic-kyc-level"}
```

<Callout icon="📘" theme="info">
  ### Note

  Your timestamp must be within 1 minute of the API server time. Make sure the time on your servers is correct.
</Callout>

Examples of how you can sign your requests:

* [JS](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/JS)
* [Java](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Java)
* [PHP (Guzzle)](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Php)
* [Python](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Python)
* [Ruby](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Ruby)
* [GO](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/GoLang)
* [C#](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/C%23)