---
title: "Create User Token"
method: POST
path: "/api/v1/users/{user_id}/token"
tags: ["External: Mobile SDK"]
---

# Create User Token

`POST /api/v1/users/{user_id}/token`

Exchange app credentials or admin auth for user-scoped access token.

Supports two authentication methods:
1. App credentials: Provide app_id and app_secret in the request body
2. Admin authentication: Authenticate as a developer/admin via Bearer token
   (app_id and app_secret can be omitted)

Both methods return access_token with refresh_token.

Returns a JWT token scoped to SDK endpoints only.
Tokens expire after configured time (default: 60 minutes).

Args:
    user_id: OpenWearables User ID (UUID)
    payload: Optional application credentials (app_id, app_secret)
    db: Database session
    developer: Optional authenticated developer (from Bearer token)

Returns:
    TokenResponse containing access_token, token_type, and refresh_token

Raises:
    401: If app credentials are invalid or admin auth is missing
    400: If neither app credentials nor admin auth is provided

## Path parameters

- `user_id` string, uuid, required

## Request body

- SDKTokenRequest — Request schema for exchanging app credentials for user token. Both fields are optional - if not provided, admin authentication is required.
  - `app_id` string, nullable
  - `app_secret` string, nullable

## Response `200`

Successful Response

- TokenResponse — Token response with optional refresh token.
  - `access_token` string, required
  - `token_type` string
  - `refresh_token` string, nullable
  - `expires_in` integer, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/openwearables/apis/open-wearables-api.md) · [All operations](https://skmtc.net/openwearables/apis/open-wearables-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openwearables/open-wearables-api/versions/37c1c527cd8f/schema)