Skip to main content

Users & Tokens

Creating users

Stream Users require only an ID to be created. Users can be created with the role of user or admin. The role will be set to user if a value is not provided in the request. There are additional properties you can provide to further describe your users.

The name and image fields are special fields that are supported by client-side SDKs.

You can provide additional data for the user object using the custom field.

const newUser: UserObjectRequest = {
id: 'userid',
role: 'user',
custom: {
color: 'red',
},
name: 'This is a test user',
image: 'link/to/profile/image',
};
await client.upsertUsers({
users: {
[newUser.id]: newUser,
},
});

Updating users

There are two ways to update user objects:

  • Updating will replace the existing user object
  • Partial update will let you choose which fields you want to change/unset
const user: UserObjectRequest = {
id: 'userid',
role: 'user',
custom: {
color: 'red',
},
name: 'This is a test user',
image: 'link/to/profile/image',
};
client.upsertUsers({
users: {
[user.id]: user,
},
});

// or
client.updateUsersPartial({
users: [
{
id: user.id,
set: {
color: 'blue',
},
unset: ['name'],
},
],
});

Anonymous users

Anonymous users are users that are not authenticated. It's common to use this for watching a livestream or similar where you aren't authenticated. Anonymous users can be connected using client-side SDKs. Anonymous users are not counted toward your MAU.

Guest users

Guest users are temporary user accounts. You can use it to temporarily give someone a name and image when joining a call. Guest users can be created client-side. Guest users are counted towards your MAU usage.

Deactivating and deleting users

While it is usually safer for data retention to deactivate a user, some use cases require completely deleting a user and their data.

Deactivating a user means:

  • the user can't connect to Stream API
  • their data will be retained
  • a deactivated user can be reactivated

Deleting a user means:

  • the user can't connect to Stream API
  • their data won't appear in user queries

Delete has the following opitions:

NameTypeDescriptionOptional
userEnum (soft, pruning, hard)- Soft: marks user as deleted and retains all user data.
- Pruning: marks user as deleted and nullifies user information.
- Hard: deletes user completely - this requires hard option for messages and conversation as well.
Yes
conversationsEnum (soft, hard)- Soft: marks all conversation channels as deleted (same effect as Delete Channels with 'hard' option disabled).
- Hard: deletes channel and all its data completely including messages (same effect as Delete Channels with 'hard' option enabled).
Yes
messagesEnum (soft, pruning, hard)- Soft: marks all user messages as deleted without removing any related message data.
- Pruning: marks all user messages as deleted, nullifies message information and removes some message data such as reactions and flags.
- Hard: deletes messages completely with all related information.
Yes
new_channel_owner_idstringChannels owned by hard-deleted users will be transferred to this userID. If you doesn't provide a value, the channel owner will have a system generated ID like delete-user-8219f6578a7395gYes
client.deleteUsers({ user_ids: ['<id>'] });

//restore
client.restoreUsers({ user_ids: ['<id>'] });
client.deactivateUser({
user_id: '<id>',
});

//reactivate
client.reactivateUsers({
user_ids: ['<id>'],
});

// deactivativating users in bulk can take some time
const deactivateResponse = client.deactivateUsers({
user_ids: ['<id1>', '<id2>'...],
});

// you need to poll this endpoint
const taskResponse = await client.getTaskStatus({id: deactivateResponse.task_id})

console.log(taskResponse.status === 'completed');

User tokens

Stream uses JWT (JSON Web Tokens) to authenticate chat users, enabling them to log in. Knowing whether a user is authorized to perform certain actions is managed separately via a role-based permissions system. Tokens need to be generated server-side.

You can optionally provide an expiration time. By default, tokens are valid for 1 hour.

const userId = 'john';
// exp is optional (by default the token is valid for an hour)
const exp = Math.round(new Date().getTime() / 1000) + 60 * 60;
client.createToken(userId, exp);

You need to provide the generated tokens to the client SDKs. Stream SDKs accept a token provider, that can be called to retrieve and renew tokens. You need to implement the token provider in your own application, this is usually an HTTP endpoint.

Call tokens

Call tokens contain a list of call IDs. When a user utilizes a call token, they will automatically be assigned the membership role for all the calls specified in the token’s claims. Additionally, the token may optionally include alternative roles, such as admin or moderator.

Note: Call tokens are designed to grant additional access, not restrict it. Most call types let regular users join calls. If all users can access any call, call tokens won't change this. Remove call access from the user role and grant it to specific members instead.

const userId = 'john';
// exp is optional (by default the token is valid for an hour)
const exp = Math.round(new Date().getTime() / 1000) + 60 * 60;

const call_cids = ['default:call1', 'livestream:call2'];

client.createCallToken(userId, call_cids, exp);

// Optionally provide a role for the call(s)
client.createCallToken({ user_id: userId, role: 'admin' }, call_cids);

Did you find this page helpful?