---
updatedAt: 2026-08-17T12:08:01.000Z
---

Fetch the complete documentation index at: https://docs.sumsub.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Authentication

To start working with the Sumsub API, all clients must authenticate themselves.

# Generate app token

An app token is a secure method of communication with our API. You can create an app token in the Dashboard, as described in [this article](https://docs.sumsub.com/sumsub/docs/app-tokens).

<Callout icon="📘" theme="info">
  ### Note

  The full-sized app token and secret key values are shown in the Dashboard only once — at the moment you create the token; make sure to save it to a secure location on your device. Once created, you will not be able to make any changes.
</Callout>

<Callout icon="👍" theme="okay">
  ### Tip

  To learn more on how to generate an app token for the [Web](/docs/web-sdk) and [Mobile](/docs/mobile-sdk) SDKs, see [this article](https://docs.sumsub.com/sumsub/reference/generate-access-token).
</Callout>

# Make requests

All requests must contain the following headers:

* `X-App-Token` — an app token that you generate in the Dashboard.
* `X-App-Access-Sig` — a request signature in the HEX format and lowercase.
* `X-App-Access-Ts` — a number of seconds since Unix Epoch in UTC.

<Callout icon="🚧" theme="warn">
  ### Attention

  All API queries must be sent over HTTPS; plain HTTP will be refused. You must include your `X-App` headers in all requests.
</Callout>

# Sign requests

The value of the `X-App-Access-Sig` header is generated with the `sha256 HMAC` algorithm using a secret key (provided upon [app token generation](https://docs.sumsub.com/sumsub/docs/app-tokens)) on the bytes obtained by concatenating the following information:

* A timestamp (value of the `X-App-Access-Ts` header) taken as a string.
* An HTTP method name in upper-case, for example, `GET` or `POST`.
* URI of the request without a host name, starting with a slash and including all query parameters, for example, `/resources/applicants/123?fields=info`
* Request body, taken exactly as it will be sent. If there is no request body, for example, for `GET` requests, do not include it.

The following is an example of the string to be signed to get an access token:

```curl
1607551635POST/resources/accessTokens/sdk{"ttlInSecs": 600, "userId": "johndoeID", "levelName": "basic-kyc-level"}
```

<HTMLBlock>{`
<div style="margin-top: 30px;"></div>
`}</HTMLBlock>

<Callout icon="📘" theme="info">
  ### Note

  Your timestamp must be within 1 minute of the API server time. Make sure the time on your servers is correct.
</Callout>

<HTMLBlock>{`
<div style="margin-top: 40px;"></div>
`}</HTMLBlock>

Examples of how you can sign your requests:

* [JS](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/JS)
* [Java](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Java)
* [PHP (Guzzle)](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Php)
* [Python](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Python)
* [Ruby](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/Ruby)
* [GO](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/GoLang)
* [C#](https://github.com/SumSubstance/AppTokenUsageExamples/tree/master/C%23)