Skip to navigation
Resource ManagementSubscribersSubscriber Tokens

Create Subscriber token

View as MarkdownOpen in Claude

Creates a Subscriber Access Token (SAT) for a known Subscriber, identified by reference, and optionally updates that subscriber’s profile. Call it from your server when a Browser SDK or other subscriber client needs to sign in. Tokens expire after two hours by default; bind one to a client with fingerprint and sat:refresh when that client should refresh its own access, or use Refresh Subscriber token from your backend.

Use Create Subscriber guest token for temporary access limited to selected resource addresses, or Create API token for server-side REST authentication.

Permissions

The API token used to authenticate must have the following scope(s) enabled to make a successful request: Voice, Messaging, Fax, or Video.

Learn more about API scopes.

Authentication

AuthorizationBasic

SignalWire Basic Authentication using Project ID and API Token.

The client sends HTTP requests with the Authorization header containing the word Basic followed by a space and a base64-encoded string of project_id:token. The project ID will be used as the username and the API token as the password.

Example:

Authorization: Basic base64(project_id:token)

Request

This endpoint expects an object.
referencestringRequired
A string that uniquely identifies the subscriber. Often it's an email, but can be any other string.
expire_atintegerOptional

A unixtime (the number of seconds since 1970-01-01 00:00:00) at which the token should no longer be valid. Defaults to ‘two hours from now’

application_idstringOptionalformat: "uuid"
The ID of the application that the token is associated with.
passwordstringOptional
Set or update the subscriber's password. Omit this field or pass an empty string if you don't want to update the password.
fingerprintstringOptionalformat: "^[A-Za-z0-9_-]+$"=43 characters

Binds the token to a specific device or browser session, letting the holder refresh it without going through your backend. The Browser SDK generates this value automatically when starting a session — forward it to your backend when requesting a token, so tie the token to that client.

Without fingerprint, your backend can still refresh the token using the companion refresh_token returned in this response.

scopeenumOptional

Grants the token’s holder permission to refresh it directly from the Browser SDK client. Pair with fingerprint to bind the token to a device.

Without this scope, your backend can still refresh the token using the companion refresh_token. If sat:refresh is set without fingerprint, the token’s lifetime is limited to 60 seconds.

Allowed values:
first_namestringOptional
Set or update the first name of the subscriber.
last_namestringOptional
Set or update the last name of the subscriber.
display_namestringOptional
Set or update the display name of the subscriber.
job_titlestringOptional
Set or update the job title of the subscriber.
time_zonestringOptional
Set or update the time zone of the subscriber.
countrystringOptional
Set or update the country of the subscriber.
regionenumOptional
A routing override that controls which regional cluster the SDK connects to.
Allowed values:
company_namestringOptional
Set or update the company name of the subscriber.

Response

The request has succeeded.
subscriber_idstringformat: "uuid"
The ID of the subscriber that the token is associated with.
tokenstringformat: "jwt"
The token that is associated with the subscriber.
refresh_tokenstringformat: "jwt"
Refresh token.

Errors

401
Unauthorized Error
404
Not Found Error
422
Unprocessable Entity Error
500
Internal Server Error