Authorization Tokens
Create Authorization Token
Create a single-use Authorization Token bound to a Donor Account.
Authorization Tokens are the binding credential used to verify a donor's identity between DAFpay and the DAF. They are used in two distinct flows:
- DAF-Initiated Setup: The DAF creates a Donor Account and then creates an Authorization Token. The DAF surfaces the token's code to the donor via their portal. The donor enters the code into DAFpay during profile setup, automatically approving the Donor Account.
- Donor-Initiated Verification: After a donor submits a Grant Request, DAFpay automatically issues an Authorization Token and emails the code to the donor. The donor provides the code to the DAF (e.g. via a portal form or phone call). The DAF then calls Verify Authorization Token with the code to verify and approve the linked Donor Account.
Tokens expire 30 days after creation by default. Override the lifetime by passing expires_in (seconds) on the request body — supported range is 60 seconds to 90 days. Once a token expires it transitions to expired and can no longer be verified; create a new token to issue a fresh code.
<Warning> The token's `code` value is **only returned once** in this response. Treat it as a credential — store it securely and never log it. If the code is lost before being verified, [revoke](/api/authorization-tokens/revoke) the token and create a new one. </Warning>post/v1/donor_accounts/{id}/authorization_tokens
Path parameters
idstring required
The unique id of the Donor Account
Request body
Example request
{
"expires_in": 2592000
}Response
Created
Example response
{
"id": "auth_token_01jpjenf5q6cawy43yxfcrxhct",
"donor_account_id": "donor_account_01jpjenf5q6cawy43yxfcrxhct",
"status": "pending",
"code": "DAFP-7K3X-9M4Q",
"created_at": "2026-04-01T12:00:00Z",
"expires_at": "2026-05-01T12:00:00Z",
"verified_at": "2026-04-02T18:30:00Z",
"revoked_at": "2026-04-02T18:30:00Z"
}