---
title: "Mint Notifications Socket Token"
method: POST
path: "/v2/notifications/socket-token"
tags: ["v2 - Notifications"]
---

# Mint Notifications Socket Token

`POST /v2/notifications/socket-token`

## Request

- Base URL: `https://api.jubjubapp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.jubjubapp.com/v2/notifications/socket-token`
- Auth: HTTP bearer

A five-minute token for the notifications WebSocket, bound to the
caller's profile and to that socket's audience (2026-09-28).

The socket used to take the Firebase session cookie on its URL, which
meant the dashboard returned that five-day, every-route credential to
page script. This token is what page script gets instead: the socket
verifies its signature, audience and expiry
(notification_socket_token.verify_socket_token) and maps it to the
profile; the API's bearer chain does not accept it at all. The caller
proves who they are with their ordinary credential to reach this route.

## Headers

- `Authorization` string
- `X-JubJub-Service-Key` string
- `X-JubJub-Agent-Key` string
- `X-JubJub-Platform-Key` string
- `Origin` string
- `Referer` string
- `X-JubJub-Trial-Token` string

## Response `200`

Successful Response

- SocketTokenResponse: What the dashboard puts on the socket URL instead of the session cookie. `expires_in` is seconds; mint again on every connect.
  - `token` string, required
  - `expires_in` integer, required
  - `audience` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/jubjubapp/apis/jubjub-api.md) - [All operations](https://skmtc.dev/jubjubapp/apis/jubjub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/jubjubapp/apis/jubjub-api/revisions/353157b296f2?raw)