Skip to content

getstream token

Sign a JWT for Stream SDKs and the API, using the app's secret. Output is a credential; treat it accordingly. Run it from a directory linked with getstream init, or point it at an app another way - see how credentials are resolved.

getstream token <user-id> [--ttl <duration>] [--app-id <id>]

Flags

Flag Effect Default
--ttl <duration> Token expiration. Units: s, m, h, d. none (token doesn't expire)
--app-id <id> Sign with this app's secret instead of the linked project's. Needs an account session that can reach the app. the resolved credentials

Examples

getstream token alice                # no expiration
getstream token alice --ttl 30s
getstream token alice --ttl 5m
getstream token alice --ttl 2h
getstream token alice --ttl 1d

Output

The JWT on stdout, with nothing else:

TOKEN=$(getstream token alice --ttl 1h)

Behavior

  • The token is signed with the resolved app's secret (--app-id, then the STREAM_API_KEY/STREAM_API_SECRET pair, then the linked project).
  • In an interactive terminal the token is also copied to the clipboard, with a Copied to clipboard. notice on stderr; stdout still carries the JWT alone, so $(...) capture is unaffected.
  • The CLI does not check whether the user id exists or whether the caller has membership in any channel involving them. It signs whatever you ask for.

See also