---
title: "Create Subscriber token"
method: POST
path: "/api/fabric/subscribers/tokens"
tags: ["Subscriber Tokens"]
---

# Create Subscriber token

`POST /api/fabric/subscribers/tokens`

Create a [Subscriber](/docs/platform/subscribers) Token.

#### Permissions

The API token used to authenticate must have the following scope(s) enabled to make a successful request: _Voice_, _Messaging_, _Fax_, or _Video_.

[Learn more about API scopes](/docs/platform/your-signalwire-api-space).

## Request body

- SubscriberTokenRequest
  - `reference` string, required — A string that uniquely identifies the subscriber. Often it's an email, but can be any other string.
  - `expire_at` integer — A unixtime (the number of seconds since 1970-01-01 00:00:00) at which the token should no longer be valid. Defaults to 'two hours from now'
  - `application_id` string, uuid — Universal Unique Identifier.
  - `password` string — Set or update the subscriber's password. Omit this field or pass an empty string if you don't want to update the password.
  - `fingerprint` string — Binds the token to a specific device or browser session, letting the holder refresh it without going through your backend. The [Browser SDK](/docs/browser-sdk/v4) generates this value automatically when starting a session — forward it to your backend when requesting a token, so tie the token to that client. Without `fingerprint`, your backend can still refresh the token using the companion [`refresh_token`](/docs/apis/rest/subscribers/tokens/refresh-subscriber-token) returned in this response.
  - `scope` 'sat:refresh' — Grants the token's holder permission to refresh it directly from the Browser SDK client. Pair with `fingerprint` to bind the token to a device. Without this scope, your backend can still refresh the token using the companion [`refresh_token`](/docs/apis/rest/subscribers/tokens/refresh-subscriber-token). If `sat:refresh` is set without `fingerprint`, the token's lifetime is limited to 60 seconds.
  - `first_name` string — Set or update the first name of the subscriber.
  - `last_name` string — Set or update the last name of the subscriber.
  - `display_name` string — Set or update the display name of the subscriber.
  - `job_title` string — Set or update the job title of the subscriber.
  - `time_zone` string — Set or update the time zone of the subscriber.
  - `country` string — Set or update the country of the subscriber.
  - `region` 'us-central' — A routing override that controls which regional cluster the SDK connects to.
  - `company_name` string — Set or update the company name of the subscriber.

## Response `200`

The request has succeeded.

- SubscriberTokenResponse
  - `subscriber_id` string, uuid, required — Universal Unique Identifier.
  - `token` string, jwt, required
  - `refresh_token` string, jwt, required

## Other responses

- `401` — Access is unauthorized.
- `404` — The server cannot find the requested resource.
- `422` — The request contains invalid parameters. See errors for details.
- `500` — An internal server error occurred.

---

[API](https://skmtc.net/signalwire/apis/signalwire-rest-api.md) · [All operations](https://skmtc.net/signalwire/apis/signalwire-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/signalwire/signalwire-rest-api/versions/05c5164b85c7/schema)