---
title: "Generate an authentication token for a customer"
method: POST
path: "/customers/{customer_id}/auth-token"
tags: ["Customers"]
---

# Generate an authentication token for a customer

`POST /customers/{customer_id}/auth-token`

## Request

- Base URL: `https://sandbox-api.paddle.com`
- URL: `https://sandbox-api.paddle.com/customers/{customer_id}/auth-token`
- Auth: HTTP bearer

Generates an authentication token for a customer. You can pass a generated authentication token to Paddle.js when opening a checkout to let customers work with saved payment methods.

Authentication tokens are temporary and shouldn't be cached. They're valid until the `expires_at` date returned in the response.

## Path parameters

- `customer_id` string, required: Unique Paddle ID for this customer entity, prefixed with `ctm_`.

## Response `200`

The request has succeeded.

- object
  - `data` CustomerAuthenticationToken, required: Represents a customer authentication token.
    - `customer_auth_token` string, required: Authentication token generated by Paddle for this customer. Pass to Paddle.js when opening a checkout to let customers work with saved payment methods.
    - `expires_at` string, date-time, required: RFC 3339 datetime string.
  - `meta` Meta, required: Information about this response.
    - `request_id` string, required: Unique ID for the request relating to this response. Provide this when contacting Paddle support about a specific request.

## Other responses

- `default`: An unexpected error response.

## Changes

- **2026-07-09** (v1) `e1ac347eb3c5`: 1 breaking
  - added the pattern `^ctm_[a-z\d]{26}$` to the `path` request parameter `customer_id`
- **2026-02-02** (v1) `9ba8be0f2006`: 2 breaking, 2 info
  - added the new path request parameter `customer_id`
  - the `data/expires_at` response's property type changed from `string` to no type, and format from `date-time` to no format for status `200`
  - added `#/components/schemas/Timestamp` to the `data/expires_at` response property `allOf` list for the response status `200`
  - the response property `data/expires_at` became required for the status `200`
- **2024-12-06** (v1) `274e5b2be190`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/paddlehq/apis/paddle-api/changes/customers/:customer_id/auth-token/post.md)

---

[API](https://skmtc.dev/paddlehq/apis/paddle-api.md) - [All operations](https://skmtc.dev/paddlehq/apis/paddle-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paddlehq/apis/paddle-api/revisions/bbc0c72039c8?raw)