---
title: "Generate a resource-scoped JWT from a direct hash."
method: POST
path: "/auth/boot"
tags: ["Auth"]
---

# Generate a resource-scoped JWT from a direct hash.

`POST /auth/boot`

Resolves a direct hash link and returns a resource-scoped JWT token. The token grants
limited access to specific resource types associated with the direct hash (e.g., aicall
for an AI direct hash). This endpoint is unauthenticated — the direct hash acts as the
credential.

## Request body

- RequestBodyAuthBootPOST — Request body for POST /auth/boot (resource-scoped JWT generation from a direct hash).
  - `direct_hash` string, required — The direct hash link (e.g., "direct.a1b2c3d4e5f6"). Obtained from resource direct hash endpoints such as `POST /ais/{id}/direct_hash_regenerate`.

## Response `200`

Resource-scoped JWT generated successfully.

- AuthBootResponse — Result of a successful boot request. Contains a resource-scoped JWT and metadata about the scoped resource.
  - `token` string — JWT token string for API authentication. Pass as `Bearer <token>` in the Authorization header.
  - `type` 'direct' — Token type. Always "direct" for boot tokens.
  - `resource_type` string — The type of resource this token is scoped to (e.g., "ai").
  - `resource_id` string, uuid — The UUID of the resource this token is scoped to. Returned from the resource creation endpoint (e.g., `POST /ais`).
  - `customer_id` string, uuid — The UUID of the customer that owns the resource. Returned from the `POST /auth/signup` response.
  - `expire` string, date-time — Token expiry timestamp in ISO 8601 format.

## Other responses

- `400` — Bad request. Possible causes: - `direct_hash` is missing or empty. - The direct hash format is invalid. - The direct hash does not resolve to any resource.

---

[API](https://skmtc.dev/voipbin/apis/voipbin-api.md) · [All operations](https://skmtc.dev/voipbin/apis/voipbin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/voipbin/voipbin-api/revisions/707e8a5ee736/schema)