Mint Universal Token

Issues a new Universal Token for a partner admin

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…

Description

  1. When expiry is omitted, the token expires 60 days from mint time.
  2. When expiry is supplied it is an absolute epoch-millisecond timestamp, and the lifetime must be at least 60 seconds and at most 60 days from now.
  3. The raw JWT is returned only once, in this response.
  4. admin email + admin clientSecret are the credential; no prior Bearer login is required.
  5. The caller must be a partner admin, and the partner must have UT minting enabled by Gupshup.
  6. Max 3 active (non-revoked, non-expired) UTs per admin user by default.
  7. Name uniqueness is among active tokens only - after revoke or natural expiry the name can be reused.
  8. A security email is sent on successful mint.

Rate limit

3 requests / 60 seconds.


API Request

Mint Universal Token — Default Expiry

curl --location --request POST 'https://partner.gupshup.io/partner/{{PARTNER_ID}}/auth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'email={{PARTNER_ADMIN_EMAIL}}' \
--data-urlencode 'clientSecret={{CLIENT_SECRET}}' \
--data-urlencode 'name=prod-automation'

Mint Universal Token — Custom Expiry

curl --location --request POST 'https://partner.gupshup.io/partner/{{PARTNER_ID}}/auth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'email={{PARTNER_ADMIN_EMAIL}}' \
--data-urlencode 'clientSecret={{CLIENT_SECRET}}' \
--data-urlencode 'name=prod-automation-7d' \
--data-urlencode 'expiry=1783939200000'

Response

Status CodeResponseComments
200{ "status": "success", "token": "eyJhbGciOiJSUzI1NiJ9...", "id": "row-id-789" }Success. Raw JWT returned once. Default lifetime = 60 days when expiry is omitted.
400{ "status": "error", "message": "name is required and must be 1..128 characters" }name missing, blank, or longer than 128 characters.
400{ "status": "error", "message": "expiry must be in the future (at least 60 seconds from now)" }Custom expiry is in the past or less than 60 seconds ahead (custom-expiry calls only).
400{ "status": "error", "message": "expiry cannot exceed 60 days from now" }Custom expiry is beyond the 60-day maximum (custom-expiry calls only).
401{ "status": "error" }Wrong or expired client secret (same message when no client-access row exists — no email enumeration).
403{ "status": "error", "message": "User-token minting is not enabled for this partner; contact admin" }Partner has ut_enabled=false.
409{ "status": "error", "message": "Maximum of 3 active tokens reached for this user; revoke one and retry" }Active UT cap reached (default 3 per admin; from cas.user-token.max-active-per-user).
409{ "status": "error", "message": "A token with this name already exists; revoke or rename it first" }Duplicate active name for this admin.
429{ "status": "error", "message": "Too Many Requests" }More than 3 requests / 60 seconds.
500{ "status": "error", "message": "Internal server error. Please try again later and If Issue still persist then contact Gupshup Dev Support" }Unexpected server failure.

Request Parameters

KeyDescriptionValuesData TypeRequired / OptionalConstraints
Path
partnerIdPartner IDe.g. 8814IntegerRequiredMust match the partner resolved from email.
Form body
emailPartner admin email[email protected]StringRequiredMust resolve to a partner admin. Non-admins receive 401.
clientSecretClient secretfrom /auth/clients/generateStringRequiredMust be current and not expired.
nameToken labelprod-automationStringRequired1–128 chars. Unique among this admin's currently active UTs.
expiryAbsolute expiry (epoch ms)e.g. 1783939200000LongOmit for default. Required for customWhen omitted → now + 60 days.


Path Params
int64
required

Partner ID. Must match the partner resolved from email (mint),
or the authenticated partner context (list and revoke).

Form Data
string
required

Partner admin email. Must resolve to a partner admin; non-admins receive 401.

string
required

Client secret from POST /partner/auth/clients/generate. Must be current and not expired.

string
required
length between 1 and 128

Token label. 1 to 128 chars. Unique among this admin's currently active UTs.

int64

Absolute expiry in epoch milliseconds (not a day count).
When omitted, defaults to now + 60 days.
When supplied, must satisfy now + 60s <= expiry <= now + 60 days.

Responses

Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json