---
title: "Mint an end-user token"
method: POST
path: "/credits/end-users/{externalUserId}/token"
tags: ["End users"]
---

# Mint an end-user token

`POST /credits/end-users/{externalUserId}/token`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/end-users/{externalUserId}/token`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Mint server-side only. Creates the tenant-scoped end-user record and credit account on first use. JWT claims are sub, tid, iss=locus-credits, aud=locus-credits-enduser, iat, exp, jti, and optional sid. The sid claim is a SHA-256 fingerprint, not the raw session value. Verification allows 30 seconds of clock skew. There is no refresh token; re-authenticate the user and mint a replacement. A sid-bound token requires the original value in X-Locus-Session-Id whenever used.

## Path parameters

- `externalUserId` string, required: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.

## Request body

- EndUserTokenRequest
  - `expiresIn` integer
  - `sessionId` string: High-entropy binding value. The JWT stores only its SHA-256 fingerprint; send the raw value as X-Locus-Session-Id.

## Response `200`

Token

- EndUserTokenResponse
  - `success` unknown, required
  - `token` string, required
  - `expiresAt` string, date-time, required
  - `expiresIn` integer, required
  - `tokenId` string, uuid, required
  - `externalUserId` string, required: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.

## Other responses

- `400`: Invalid externalUserId, expiresIn, sessionId, or unknown field

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)