---
title: "Create a Client Token"
method: POST
path: "/client-side-tokens"
tags: ["Core", "Client Tokens"]
---

# Create a Client Token

`POST /client-side-tokens`

## Request

- Base URL: `https://api.evervault.com`
- URL: `https://api.evervault.com/client-side-tokens`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/evervault/apis/evervault-api/docs/client-side-tokens/post.ts> (a function with typed inputs; its response is checked against the schema)

Client-Side Tokens are restricted to specific payloads. By default, a Client-Side Token will expire after 5 minutes. The maximum expiration time of a token is 10 minutes. When using the REST API, the expiry field must be in epoch milliseconds.

## Request body

- object
  - `action` 'api:decrypt', required: The action that the token should permit
  - `payload` object: The payload that the token must be used with
  - `expiry` integer: The expiry of the token in milliseconds format. Must be less than 10 minutes from now.
  - `externalCustomerReference` string: An optional reference of your choice, such as a correlation ID, that is attached to the request. The reference will be visible in your logs. Must be between 1 and 255 characters.

## Response `201`

A client side token and its expiry

- ClientSideToken
  - `id` string, required: The id of the token
  - `token` string, required: The token
  - `expiry` integer, required: The expiry of the token in unix millis format
  - `createdAt` integer, required: The creation time of the token in unix millis format

## Changes

- **2026-11-06** `8d0ca833fa04`: 5 info
  - added the new optional request property `externalCustomerReference`
  - the response property `createdAt` became required for the status `201`
  - the response property `expiry` became required for the status `201`
  - the response property `id` became required for the status `201`
  - …1 more
- **2025-11-18** `30ea25af4354`: 3 info
  - api tag `Client Tokens` added
  - api tag `Core` added
  - api tag `client-side-tokens` removed

[Operation history](https://skmtc.dev/evervault/apis/evervault-api/changes/client-side-tokens/post.md)

---

[API](https://skmtc.dev/evervault/apis/evervault-api.md) - [All operations](https://skmtc.dev/evervault/apis/evervault-api/llms.txt) - [OpenAPI document](https://skmtc.dev/evervault/apis/evervault-api/revisions/8d0ca833fa04?raw)