---
updatedAt: 2026-09-17T13:51:15.000Z
agentTools:
projectIndex: https://docs.sumsub.com/llms.txt
---
# Generate access token
# Overview
Use this method to generate a new access token:
* When integrating with the [WebSDK](https://docs.sumsub.com/sumsub/docs/web-sdk) and [MobileSDK](https://docs.sumsub.com/sumsub/docs/mobile-sdk) where an access token authentication is required.
* When it is required for [applicant actions](https://docs.sumsub.com/sumsub/reference/about-applicant-actions).
> The lifespan of a token depends upon the value specified in the `ttlInSecs` field.
### Important
- To initialize the SDKs for the [Sandbox environment](https://docs.sumsub.com/sumsub/docs/sandbox-mode), make sure to use the **App token** and **Secret key** pair [that was created](https://docs.sumsub.com/sumsub/docs/app-tokens) in Sandbox mode for [request authorization headers](https://docs.sumsub.com/sumsub/reference/authentication#make-requests).
- Access tokens for applicants have limited access to the API. For example, a single access token is only valid for one applicant and cannot access other applicants.
## Required permissions
To use this method, no particular [permission](https://docs.sumsub.com/sumsub/docs/user-roles#permissions) is required on the [app token](https://docs.sumsub.com/sumsub/docs/app-tokens) — a valid API token is sufficient.
## Request example
```curl
curl -X POST \
'https://api.sumsub.com/resources/accessTokens/sdk' \
-H 'content-type: application/json' \
-H 'X-App-Token: ' \
-H 'X-App-Access-Sig: ' \
-H 'X-App-Access-Ts: ' \
-d '{
"applicantIdentifiers": {
"email": "john.doe@domain.com",
"phone": "555-1111"
},
"ttlInSecs": 600,
"userId": "johndoeID",
"levelName": "basic-kyc-level"
}'
```
# Response explained
In the response, you will get a new token for the specified applicant.
The following fields are returned:
| Field | Description |
| :------- | :------------------------------------------------------------------------ |
| `token` | The access token generated upon execution of the request. |
| `userId` | The unique applicant identifier on your side as specified in the request. |
The following is a response example in case the request is sent and processed correctly:
```json
{
"token": "_act-b8ebfb63-5f24-4b89-9c08-000000000000",
"userId": "johndoeID"
}
```
If the request fails, you will receive an HTTP response containing an error code along with a message explaining the error. For example:
```json
{
"description": "Request signature mismatch",
"code": 401,
"correlationId": "f677f38a9998b13c572a2a0000000000",
"errorCode": 4003,
"errorName": "app-token-signature mismatch"
}
```
# OpenAPI definition
```json
{
"openapi": "3.1.0",
"info": {
"title": "sumsub-api",
"version": "1.0"
},
"servers": [
{
"url": "https://api.sumsub.com"
}
],
"components": {
"securitySchemes": {
"sec0": {
"type": "apiKey",
"name": "X-App-Token",
"in": "header",
"x-default": ""
}
}
},
"security": [
{
"sec0": []
}
],
"paths": {
"/resources/accessTokens/sdk": {
"post": {
"summary": "Generate access token",
"description": "",
"operationId": "generate-access-token",
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"required": [
"userId",
"levelName"
],
"properties": {
"userId": {
"type": "string",
"description": "Unique applicant identifier on your side that will be bound to the token. It correlates to the `externalUserId` of the applicant."
},
"levelName": {
"type": "string",
"description": "Name of the [verification level](https://docs.sumsub.com/sumsub/docs/verification-levels). The level determines the verification steps the applicant must complete and the [documents that are required](/reference/get-applicant-data#requirediddocs-attributes) for verification.
⚠️ Mind the following: - A level has to be created in the same [environment](https://docs.sumsub.com/sumsub/docs/sandbox-mode). For example, in the Sandbox mode, you may not be able to use a level configured to be only available in the Production environment.
- A level name is case-sensitive.
Kyc-level and kyc-level are considered as completely different level names. The system does not allow creating an applicant with the level name that does not exist. - The system does not allow creating a company profile with a level for individuals and vice versa.
"
},
"applicantIdentifiers": {
"type": "object",
"description": "Contains the information about the applicant email address and phone number. When specified, the applicant email address and phone number will be automatically added to the applicant profile.",
"properties": {
"email": {
"type": "string",
"description": "Applicant email address."
},
"phone": {
"type": "string",
"description": "Applicant phone number."
}
}
},
"externalActionId": {
"type": "string",
"description": "Unique applicant action identifier on your side that will be bound to the token.
⚠️ Only required when generating an access token for [applicant actions](https://docs.sumsub.com/sumsub/reference/about-applicant-actions). Do not use for standard levels."
},
"ttlInSecs": {
"type": "integer",
"description": "Lifespan of the generated token in seconds. Default value is 10 mins.",
"default": 600,
"format": "int32"
}
}
}
}
}
},
"deprecated": false
}
}
},
"x-readme": {
"headers": [],
"explorer-enabled": true,
"proxy-enabled": true
},
"x-readme-fauxas": true
}
```