post
https://partner.gupshup.io/partner/app//token
Issues a new Universal App Token scoped to a single app.
Recent Requests
Log in to see full request history
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Loading…
Description
- When expiry is omitted the token expires 24 hours from mint time.
- When expiry is supplied it is an absolute epoch-millisecond timestamp, and must satisfy now + 1h <= expiry <= now + 24h.
- The raw JWT is returned only once, in this response.UT bearer only - portal login, legacy partner token, static app token, or external JWT are rejected.
- Max 3 active UATs per app by default.
- Name uniqueness is among active tokens for that app; after revoke or natural expiry the name can be reused.
- No email is sent on UAT mint.
Rate limit
10 requests / 60 seconds
API Request
Default Expiry (24 hours)
curl --location --request POST 'https://partner.gupshup.io/partner/app/{{APP_ID}}/token' \
--header 'Authorization: Bearer {{UNIVERSAL_TOKEN}}' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'name=webhook-service'Custom Expiry
curl --location --request POST 'https://partner.gupshup.io/partner/app/{{APP_ID}}/token' \
--header 'Authorization: Bearer {{UNIVERSAL_TOKEN}}' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'name=webhook-service-2h' \
--data-urlencode 'expiry=1783075200000'Replace 1783075200000 with an epoch-ms timestamp that is within 1 hour … 24 hours from the request time.
Response
| Status Code | Response | Comments |
|---|---|---|
| 200 | { "status": "success", "token": "eyJhbGciOiJSUzI1NiJ9...", "id": "6f2c9e1a-..." } | Success. Raw JWT returned once. Default TTL = 24h when expiry omitted. |
| 400 | { "status": "error", "message": "name is required and must be 1..128 characters" } | name blank or longer than 128 characters. |
| 400 | { "status": "error", "message": "expiry must be in the future (at least 1 hour from now)" } | Custom expiry is in the past or less than 1 hour ahead. |
| 400 | { "status": "error", "message": "expiry cannot exceed 24 hours from now" } | Custom expiry is beyond the 24-hour maximum. |
| 400 | { "status": "error", "message": "Partner is not authorized" } | App is not linked to the authenticated partner (InvalidParameterException → 400). |
| 401 | { "status": "error", "message": "Unauthorised access to the resource. Please review request parameters and headers and retry" } | Missing/invalid authentication (JwtAuthenticationEntryPoint). |
| 409 | { "status": "error", "message": "Maximum of 3 active UAT tokens reached for this app; revoke one and retry" } | Active UAT cap reached (default 3 per app). |
| 409 | { "status": "error", "message": "A token with this name already exists; revoke or rename it first" } | Duplicate active name for this app. |
| 429 | { "status": "error", "message": "Too Many Requests" } | More than 10 requests / 60 seconds. |
| 500 | { "status": "error", "message": "Internal server error. Please try again later and If Issue still persist then contact Gupshup Dev Support" } | Unexpected server failure. |
Request Parameters
| Key | Description | Values | Data Type | Required / Optional | Constraints |
|---|---|---|---|---|---|
| Headers | |||||
| Authorization | UT Bearer token | Bearer {{UNIVERSAL_TOKEN}} | String | Required | Must be a verified UT. |
| Content-Type | Form encoding | application/x-www-form-urlencoded | String | Required | Form body. |
| Path | |||||
| appId | App ID | UUID | String | Required | Must be linked to the caller's partner. |
| Form body | |||||
| name | Token label | webhook-service | String | Required | 1–128 chars. Unique among this app's currently active UATs. |
| expiry | Absolute expiry epoch ms | e.g. 1783075200000 | Long | Optional | Omit → 24h default. If set: now + 1h ≤ expiry ≤ now + 24h. |