> ## Documentation Index
> Fetch the complete documentation index at: https://social-b97141fb-feat-user-history-moderation-detail.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# User Token Management

> Learn how to manage user authentication tokens and credentials in social.plus SDK

Use `AmityUserTokenManager` or the TypeScript `createUserToken(...)` helper to create user credentials for flows that require a user access token. This includes access to some beta features and server-side API workflows.

> [!WARNING]
>
> The generated access token is not used by normal client SDK login. Create and consume these tokens only from a backend, tool, or trusted workflow where the token is not exposed to end users.

## Parameters

| Parameter | Required | Platforms | Description |
| - | - | - | - |
| `apiKey` | Yes | TypeScript, iOS, Android, Flutter | API key used to create the token manager or token request. Keep it in a trusted runtime when generating tokens. |
| `region` / `endpoint` | Yes | TypeScript, iOS, Android, Flutter | Region or endpoint used to route the token request. |
| `userId` | Yes | TypeScript, iOS, Android, Flutter | Unique identifier of the user whose credentials are created. |
| `displayName` | No | TypeScript, iOS, Android, Flutter | Display name associated with the user credentials when provided. |
| `authToken` / `secureToken` | No | TypeScript, iOS, Android, Flutter | Secure authentication token used when your app enables secure mode. |

## Create a user token

To create a user token, pass the user's identifier and optional secure-mode credentials from a trusted workflow.

Create the token with the SDK surface for your platform.

```typescript TypeScript theme={null}
import { API_REGIONS, createUserToken } from '@amityco/ts-sdk';

const { accessToken } = await createUserToken('your-api-key', API_REGIONS.SG, {
  userId: 'user_123',
  displayName: 'Jane Doe',
  authToken: 'secure-token',
});

console.log(accessToken);
```

```swift iOS theme={null}
// 1. create AmityUserTokenManager instance.
let userTokenManager = AmityUserTokenManager(apiKey: "<api-key>", region: .SG)

func createNewUserTokenExample() async {
    // 2. call `createUserToken` on AmityUserTokenManager.
    do {
        let auth = try await userTokenManager.createUserToken(
            userId: "<user-id>",
            displayName: "<(optional)-display-name>",
            authToken: "<(optional)-auth-token>"
        )
        print("auth.accessToken: \(auth.accessToken)")
    } catch {
        print("unable to create a new user token: \(error.localizedDescription)")
    }
}
```

```kotlin Android theme={null}
fun createUserToken(
    userId: String,
    displayName: String,
    apiKey: String,
    endpoint: AmityEndpoint,
    authToken: String?
) {
    AmityUserTokenManager(
        apiKey = apiKey,
        endpoint = endpoint
    ).createUserToken(
        userId = userId,
        displayName = displayName,
        secureToken = authToken
    )
        .doOnSuccess { userToken : AmityUserToken ->
            // AmityUserToken
            val accessToken = userToken.accessToken
        }
        .doOnError {
            // Exception
        }
        .subscribe()
}
```

```dart Flutter theme={null}
void createUserToken(String userId, String displayname, String secureToken) {
  AmityUserTokenManager(
          apiKey: "your api key", endpoint: AmityRegionalHttpEndpoint.SG)
      //displayname and secureToken are optional
      .createUserToken(userId,
          displayname: displayname, secureToken: secureToken)
      .then((AmityUserToken token) {
          log("accessToken = ${token.accessToken}");
  });
}
```

## Token security

> **Secure storage**
>
> * Store tokens securely on the server side.
> * Use encryption for token storage.
> * Implement token rotation policies.
> * Never expose tokens in client-side code.

> **Network security**
>
> * Always use HTTPS for token transmission.
> * Implement proper authentication headers.
> * Use secure communication channels.
> * Log token usage for audit purposes.

## Best Practices

> **Token management**
>
> * Cache tokens to avoid unnecessary creation.
> * Implement token validation before usage.
> * Use connection pooling for better performance.
> * Handle token expiration gracefully.

> **Error handling**
>
> * Implement comprehensive error handling.
> * Log all token operations for debugging.
> * Provide meaningful error messages.
> * Implement retry logic for transient failures.

> **Performance**
>
> * Batch token operations when possible.
> * Use background processing for token creation.
> * Implement caching strategies.
> * Monitor token usage patterns.

## Related Topics

> **[User Authentication](../../../getting-started/authentication)**
>
> Learn about standard user login and authentication.

> **[API Integration](/api-reference/introduction)**
>
> Explore social.plus API documentation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.