---
title: "POST /resources/accessTokens/sdk"
method: POST
path: "/resources/accessTokens/sdk"
tags: ["AccessTokenApiResource"]
---

# POST /resources/accessTokens/sdk

`POST /resources/accessTokens/sdk`

## Request body

- AccessTokenCreationDto
  - `applicantId` string — A unique identifier of the user who passed user verification (KYC). You can share this identifier with your partners.
  - `applicantIdentifiers` ApplicantIdentifiers
    - `email` string
    - `externalUserId` string
    - `googleSub` string
    - `passwordlessAuthId` string
    - `phone` string
  - `externalActionId` string — A unique applicant action identifier on your side that will be bound to the token. <br><br>⚠️ It is required when you generate an access token for [applicant actions](ref:about-applicant-actions).
  - `kytTxnId` string
  - `levelName` string — A [verification level](doc:verification-levels) name. The level determines the verification steps the applicant must complete and the [documents that are required](/reference/get-applicant-data#requirediddocs-attributes) for verification. <br><br>⚠️ Mind the following: <ul><li>A level has to be created in the same [environment](doc:sandbox-mode). For example, in the Sandbox mode, you may not be able to use a level configured to be only available in the Production environment.</li><li>A level name is case-sensitive. <code>Kyc-level</code> and <code>kyc-level</code> are considered as completely different level names. The system does not allow creating an applicant with the level name that does not exist.</li><li>If a level name contains reserved characters (e.g., <code>@</code>, <code>+"</code>, white spaces as <code>%20</code>), it should be URL-encoded, otherwise you may get a signature mismatch.</li><li>The system does not allow creating a company profile with a level for individuals and vice versa.</li></ul>
  - `redirect` WebSdkRedirectConf
    - `allowedQueryParams` string[]
    - `rejectUrl` string
    - `signKey` string
    - `successUrl` string, required
  - `shareToken` string
  - `ttlInSecs` integer — The lifespan of the generated token in seconds. Default value is 10 mins.
  - `userId` string — A unique applicant identifier on your side that will be bound to the token. It correlates to the `externalUserId` of the applicant. <br><br>⚠️ If your `userId` contains reserved characters (e.g., `@`, `+"`, white spaces as `%20`), it should be URL-encoded, otherwise you may get a signature mismatch.
  - `workflowName` string

## Response `default`

default response

- AccessToken
  - `applicantId` string
  - `applicantIdentifiers` ApplicantIdentifiers
    - `email` string
    - `externalUserId` string
    - `googleSub` string
    - `passwordlessAuthId` string
    - `phone` string
  - `externalActionId` string
  - `forClientId` string
  - `forIp` string
  - `redirectParams` WebSdkRedirectParams
    - `rejectUrl` string
    - `signKey` string
    - `successUrl` string, required
  - `refreshToken` boolean
  - `reusableKycConf` ReusableKycConf
    - `shareToken` string
  - `sharingAllowed` boolean
  - `sumsubIdProfileId` string
  - `token` string
  - `type` 'shareToken' | 'sumsubIdShareToken'
  - `userId` string

---

[API](https://skmtc.net/sumsub/apis/sumsub-api-service.md) · [All operations](https://skmtc.net/sumsub/apis/sumsub-api-service/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sumsub/sumsub-api-service/revisions/cd1cf0bbd4f9/schema)