Access Token
Last updated
Last updated
To use Smart Auth SDK, you will need to generate two access tokens: one for Smart Auth and another one for Face Liveness. This page shows the steps on how to create the keys, generate the access tokens and the recommended ways to do it.
Go to to see how to generate it.
Go to the ;
If you do not have a token, generate one.
Retrieve the clientId
and clientSecret
from one of the generated tokens.
Do not store these fields directly in your mobile/web application. These values should not leave your backend.
The following steps describe how you can generate a token that is valid only for a specific user. This is the recommended way to generate and distribute tokens because it limits a possible attack to a single user account.
At some point in your application flow, create a JWT with the structure of the example below;
Remember to replace the {clientId}
, {personId}
and {expiresAt}
fields.
All of these fields are strongly recommended, but you can see which ones are required at the bottom of this page.
Sign the token with your clientSecret
;
Send this token to your application.
Example:
Keep the Header field, do not change;
Edit the payload, only the iss
field is required;
Replace **** your-256-bit-secret
with your clientSecret
;
Click Share JWT to copy the generated token to the clipboard;
Use this token to authenticate the SDK.
iss
Yes
Your clientId
exp
No
personId
No
The CPF (Individual Taxpayer Registration Number) for which the token will be valid
Go to ;
Expiration time (seconds since the )