---
title: "Generate a client access token"
method: POST
path: "/client_auth_token"
tags: ["SDK Authorization"]
---

# Generate a client access token

`POST /client_auth_token`

Generates a temporary JWT access token used to initialize zerohash SDK modules on behalf of one of your end users. The platform authenticates to this endpoint with its own HMAC credentials; the returned JWT is then handed to the end-user client. Either `participant_code` or `email` must be provided to identify the end user the token is issued for.

## Headers

- `X-SCX-SIGNED` string, required
- `X-SCX-TIMESTAMP` string, required

## Request body

- union
  - ClientAuthTokenFull — Schema containing ALL optional fields and ALL permission types.
    - `participant_code` string — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `email` string — The email address of the user the SDK token is created for. Used for pre-onboarding flows. Either `participant_code` or `email` must be provided.
    - `phone_number` string — Phone number of the user the SDK token is created for. Used for pre-onboarding flows.
    - `otp_verified` 'email' | 'sms' — Indicates which channel the end user verified via OTP before this token was requested.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `merchant_participant_code` string — Optional merchant participant code associated with the transaction. When omitted, the platform itself is treated as the merchant.
    - `permissions` string[], required — One or more SDK experiences requested for this token. The following permissions are supported.
    - `withdrawal_details` object — Details for crypto withdrawals and payouts.
      - `quoted_asset` string, required — The asset code for the withdrawal request, e.g. USD
      - `withdrawal_request_amount` string, required — The amount requested for withdrawal.
      - `external_account_id` string, required — The external account ID for the withdrawal.
      - `account_label` string — The account label for the withdrawal to be taken from.
    - `deposit_details` object — Account deposit details.
      - `account_label` string, required — The account label for the deposited funds.
      - `external_wallet_address` string — Platform-owned wallet address to receive the crypto deposit. Only valid with the `crypto-deposits` permission. When omitted, the deposit is routed to a zerohash internal wallet (internal mode).
      - `deposit_amount` string — The amount, denominated in `denominated_currency`, that is pre-filled and uneditable by the user. usable only if `permission` = `fwc` and the Platform is using AUTH.
      - `denominated_currency` string — The currency in which `deposit_amount` is denominated. Only `USD` is supported.
    - `payment_details` object — Details for crypto payments.
      - `purchase_amount` string, required — The amount of the purchase in the `denominated_currency`.
      - `denominated_currency` string, required — The currency in which the `purchase_amount` is denominated.
    - `client_device_info` object — Metadata about the client environment where the SDK is initialized.
      - `ip_address` string, required — The public IP address of the end-user device.
      - `location` string, required — The location of the end-user device in ISO 3166-2 format (country-state, e.g., US-IL).
    - `custom_fees_and_spreads` object — Custom fees and spreads for crypto buy/sell.
      - `crypto_buy` object
        - `spread_bps` string — The custom spread in basis points to be applied to the buy quote.
        - `fees` object[] — An array of custom fees to be applied to the buy quote.
          - `type` 'bps' | 'notional' — The type of fee (e.g., percentage, flat).
          - `amount` string — The value of the fee `type`.
          - `name` string — The name of the fee.
      - `crypto_sell` object
        - `spread_bps` string — The custom spread in basis points to be applied to the sell quote.
        - `fees` object[] — An array of custom fees to be applied to the sell quote.
          - `type` 'bps' | 'notional' — The type of fee (e.g., percentage, flat).
          - `amount` string — The value of the fee `type`.
          - `name` string — The name of the fee.
  - object — Account Funding SDK token with optional deposit details preconfigured.
    - `permissions` string[], required — One or more SDK experiences requested for this token.
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `deposit_details` object — Account deposit details.
      - `account_label` string, required — The account label for the deposited funds.
      - `external_wallet_address` string — Platform-owned wallet address to receive the crypto deposit. Only valid with the `crypto-deposits` permission. When omitted, the deposit is routed to a zerohash internal wallet (internal mode).
      - `deposit_amount` string — The amount, denominated in `denominated_currency`, that is pre-filled and uneditable by the user. usable only if `permission` = `fwc` and the Platform is using AUTH.
      - `denominated_currency` string — The currency in which `deposit_amount` is denominated. Only `USD` is supported.
    - `client_device_info` object — Metadata about the client environment where the SDK is initialized.
      - `ip_address` string, required — The public IP address of the end-user device.
      - `location` string, required — The location of the end-user device in ISO 3166-2 format (country-state, e.g., US-IL).
  - object — All accepted fields for a customer
    - `permissions` string[], required — One or more SDK experiences requested for this token.
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
  - object — Account Funding SDK token with withdrawal details preconfigured. Registered external account is required for Account Funding - Withdrawals.
    - `permissions` string[], required — One or more SDK experiences requested for this token.
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `withdrawal_details` object, required — Details for crypto withdrawals and payouts.
      - `quoted_asset` string, required — The asset code for the withdrawal request, e.g. USD
      - `withdrawal_request_amount` string, required — The amount requested for withdrawal.
      - `external_account_id` string, required — The external account ID for the withdrawal.
      - `account_label` string — The account label for the withdrawal to be taken from.
  - object — Participant Profile SDK for viewing and managing participant information.
    - `permissions` string[], required — One or more SDK experiences requested for this token.
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
  - object — Payins SDK for launching digital asset payment experiences.
    - `permissions` string[], required — One or more SDK experiences requested for this token.
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `payment_details` object, required — Details for crypto payments.
      - `purchase_amount` string, required — The amount of the purchase in the `denominated_currency`.
      - `denominated_currency` string, required — The currency in which the `purchase_amount` is denominated.
    - `client_device_info` object — Metadata about the client environment where the SDK is initialized.
      - `ip_address` string, required — The public IP address of the end-user device.
      - `location` string, required — The location of the end-user device in ISO 3166-2 format (country-state, e.g., US-IL).
    - `merchant_participant_code` string — Optional merchant participant code associated with the transaction. When omitted, the platform itself is treated as the merchant.
  - object — Crypto Withdrawals SDK for launching digital asset withdrawal experiences easily.
    - `permissions` string[], required
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `withdrawal_details` object — Details for crypto withdrawals and payouts.
      - `quoted_asset` string, required — The asset code for the withdrawal request, e.g. USD
      - `withdrawal_request_amount` string, required — The amount requested for withdrawal.
      - `external_account_id` string, required — The external account ID for the withdrawal.
      - `account_label` string — The account label for the withdrawal to be taken from.
    - `client_device_info` object — Metadata about the client environment where the SDK is initialized.
      - `ip_address` string, required — The public IP address of the end-user device.
      - `location` string, required — The location of the end-user device in ISO 3166-2 format (country-state, e.g., US-IL).
  - object — One or more SDK experiences requested for this token.
    - `permissions` string[], required
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `withdrawal_details` object — Details for crypto withdrawals and payouts.
      - `quoted_asset` string, required — The asset code for the withdrawal request, e.g. USD
      - `withdrawal_request_amount` string, required — The amount requested for withdrawal.
      - `external_account_id` string, required — The external account ID for the withdrawal.
      - `account_label` string — The account label for the withdrawal to be taken from.
  - object — One or more SDK experiences requested for this token.
    - `permissions` string[], required
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `custom_fees_and_spreads` object
      - `crypto_buy` object
        - `spread_bps` string — The custom spread in basis points to be applied to the buy quote.
        - `fees` object[] — An array of custom fees to be applied to the buy quote.
          - `type` 'bps' | 'notional' — The type of fee (e.g., percentage, flat).
          - `amount` string — The value of the fee `type`.
          - `name` string — The name of the fee.
  - object — One or more SDK experiences requested for this token.
    - `permissions` string[], required
    - `participant_code` string, required — The participant_code for whom the SDK token is created. Either `participant_code` or `email` must be provided.
    - `reference_id` string — Optional platform-defined ID to link downstream events
    - `custom_fees_and_spreads` object
      - `crypto_sell` object
        - `spread_bps` string — The custom spread in basis points to be applied to the sell quote.
        - `fees` object[] — An array of custom fees to be applied to the sell quote.
          - `type` 'bps' | 'notional' — The type of fee (e.g., percentage, flat).
          - `amount` string — The value of the fee `type`.
          - `name` string — The name of the fee.

## Response `201`

Client access token successfully generated.

- union
  - object
    - `message` object
      - `token` string, required — JWT access token used to initialize zerohash SDK modules.
  - object
    - `message` object
      - `token` string, required — JWT access token used to initialize zerohash SDK modules.
      - `deposit_intent_id` string, nullable — When permission is `fwc` this field will contain an id to be correlated with the fund deposit
  - object
    - `message` object
      - `token` string, required — JWT access token used to initialize zerohash SDK modules.
      - `payment_id` string, nullable — Only present when permissions include `crypto-withdrawals` or `crypto-payouts`.

## Other responses

- `400` — Bad Request
- `403` — The transaction is not authorized. Possible causes: manual approval is required before this transaction can proceed (Level 4 shoppers — the body contains a transaction_id identifying the approval review), or the shopper has exceeded their daily spend limit at the current authorization level. A generic `{"error":"Transaction not authorized"}` body is returned when the transaction is hard-denied (no remediation).
- `404` — Not Found
- `409` — Shopper KYC requirements are not met for this transaction.
- `422` — The transaction could not be authorized. The `{"error": ...}` body is either "Participant is not authorized to transact" (the participant/merchant relationship or state precludes authorization) or "Transaction not authorized" (the authorizer returned an unrecognized status).
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/zerohash/apis/zerohash-api.md) · [All operations](https://skmtc.net/zerohash/apis/zerohash-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/zerohash/zerohash-api/revisions/8b647d934363/schema)