Creating Tokens

Query Arguments for Tokens

The following HTTP request URI query arguments control the creation of a token:

No query args

Causes the default behavior as if setcookie=true was specified.


Causes the HTTP response to contain a Cookie header that causes a web browser to replace the current authentication token with the newly generated one.


Causes the HTTP response to contain the header Gateway-Token instead of the standard Cookie header. Use this to have the browser continue using its current authentication token.


The Gateway-Token header is the same for both SCSP and S3 tokens.

Request Headers for Tokens

The following HTTP request headers control the creation of a token:




Used by the tokenAdmin user to create a token on behalf of another user. An error is returned if any user other than the token administrator attempts to set this header.

By default, the owner of a token is the user that creates it.




Sets the expiration time for the authentication token. See below for ways to express time.

If this header is not given, the default expiration time is set based on Gateway's tokenTTLHours configuration setting, which defaults to 24 hours after token creation.




Sets an S3 secret key that is used for signing S3 requests. The token is used to sign S3 storage requests when this header is present. The token cannot be used to authenticate SCSP storage or Management API operations. Values of this string must follow Swarm metadata value rules for encoding, and 7-bit ASCII values are recommended.




Additional custom metadata that is saved with the token. This is for application-specific purposes and it is not interpreted by the Gateway during token creation or use.




This metadata header is displayed as the Description of the token in the Content UI.

You have numerous options for how to specify the time for the token's expiration:

POSIX time



Integer value that is the number of seconds elapsed since 00:00:00. Coordinated Universal Time (UTC), 1 January 1970, not counting leap seconds.

Days offset



Integer number of days (86,400 sec/day) from now.

Year only



Four-digit year; the expiration is on January 1st at 00:00Z of that year.

Specific day



Year, month, and day; the expiration is at 00:00Z on that day.

ISO timespec



ISO time specification; all digits and fixed characters must be supplied; only UTC ("Z") time zone is allowed.

Token Examples

Creating a domain token
POST http://{domain}/.TOKEN/ Auth: john:password HTTP/1.1 201 Created Gateway-Request-Id: 41B8FD0D739DF86C  Set-Cookie: token=d9f8378f71e79b77831f65d9e6891af6; path=/ Content-Length: 0
Creating a tenant token for S3
POST http://{domain}/_admin/manage/tenants/tenant256/tokens/ Auth: john:password X-User-Token-Expires-Meta: +730 X-User-Secret-Key-Meta: 5ZdMSEubcFHJjnkyEzy722ZQHjd2xsTo X-Custom-Meta-Source: Laptop Applications   HTTP/1.1 201 Created Gateway-Request-Id: 7612F7FDB63B7C02  Set-Cookie: token=cc8ea2467d196b047497818f6271f00c; path=/ Content-Length: 0
Creating a tenant token for S3 with cURL
$ USER="john" $ SECRETKEY="1NnYIOXeHfuuW30eARH19iJQXNvvjMSF" $ EXPIRES="+365" $ curl -u $USER -X POST --data-binary "" \ -H "X-User-Secret-Key-Meta: $SECRETKEY" \ -H "X-User-Token-Expires-Meta: $EXPIRES" \ "" Enter host password for user 'john': {"token":"8c3955185d3ae8347caca1a14e4e2416", ... }


© DataCore Software Corporation. · · All rights reserved.