# Generate a test token

Use `getstream token` to sign a JWT with the linked app's secret. Useful for local SDK work and one-off API calls, but **not** for production token issuance. Run it from a directory linked with `getstream init`.

## Generate a token

```bash
getstream token alice                # no expiration
getstream token alice --ttl 30s
getstream token alice --ttl 5m
getstream token alice --ttl 2h
getstream token alice --ttl 1d
```

`--ttl` units: `s`, `m`, `h`, `d`.

## Call the API as a user

`getstream token` prints just the JWT on stdout, so you can capture it directly. The app's API key is in `.stream/creds.yaml`:

```bash
TOKEN=$(getstream token alice --ttl 1h)
API_KEY=$(grep '^key:' .stream/creds.yaml | awk '{ print $2 }')

curl -X POST "https://chat.stream-io-api.com/api/v2/chat/channels?api_key=$API_KEY" \
  -H "Stream-Auth-Type: jwt" \
  -H "Authorization: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"filter_conditions":{"members":{"$in":["alice"]}},"limit":10}'
```

This queries alice's channels the way an SDK would, with the request authenticated as her. The members filter is required: a user token only reads channels its user can access, so the API rejects an unscoped query.

## Test an SDK locally

Paste the printed JWT into your SDK's connect call. This skips the need to stand up a token endpoint for early integration work.

## When not to use this

- **Production.** Issue tokens from [your own server endpoint](https://getstream.io/docs/platform/authentication/) with proper auth.
- **Users you don't own.** The CLI signs tokens for any user id with no membership check. Only appropriate when you control both ends.

## Related

- [`getstream token` reference](https://getstream.io/cli/docs/commands/token/)
- [`getstream env`](https://getstream.io/cli/docs/commands/env/): write SDK keys into your project

---

For the most recent version of this documentation, visit [https://getstream.io/cli/docs/test-tokens/](https://getstream.io/cli/docs/test-tokens/).