---
title: "Issue Contact Token"
method: POST
path: "/v1/contacts/tokens"
tags: ["contacts"]
---

# Issue Contact Token

`POST /v1/contacts/tokens`

## Request

- Base URL: `https://api.elaan.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.elaan.io/v1/contacts/tokens`
- Auth: none declared

Mint a short-lived, contact-scoped token for the tenant's backend to hand
to that contact's browser. Tenant-level only (router gate). The browser then
calls the contact-facing endpoints directly, scoped to this contact.

## Headers

- `authorization` string, nullable

## Request body

- ContactTokenRequest: A tenant backend asking for a short-lived token scoped to one of its contacts (by the tenant's own `external_id`), to hand to that contact's browser.
  - `external_id` string, required

## Response `200`

Successful Response

- ContactTokenResponse: A contact-scoped bearer token. The frontend uses it to call the contact-facing endpoints (inbox, push tokens, preferences, the SSE stream) for *this* contact only; re-mint from the tenant's session when it expires. `contact_id` is the contact's *internal* id — the one the contact-facing URLs take (e.g. `/v1/contacts/{contact_id}/stream`). The backend passes the tenant's own `external_id` in and gets both the token and the internal id back, so it can hand the browser everything it needs without tracking internal ids itself.
  - `token` string, required
  - `token_type` string
  - `expires_in` integer, required
  - `contact_id` string, required

## Other responses

- `404`: No contact with this external_id
- `422`: Validation Error

---

[API](https://skmtc.dev/elaan/apis/elaan-api.md) · [All operations](https://skmtc.dev/elaan/apis/elaan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaan/apis/elaan-api/revisions/c96a7e6399aa?raw)