Application tokens

Application tokens are the recommended way to authenticate with the emnify REST API for machine-to-machine (M2M) communications. Unlike user credentials, application tokens don’t require storing passwords on your servers or dealing with multi-factor authentication (MFA).

Key benefits:

• Create multiple tokens for different applications or environments
• Restrict tokens to specific IP address ranges
• Set expiration dates for automatic revocation
• Revoke individual tokens at any time without affecting others

Security best practices:

• Always set an expiration date for production tokens
• Use IP restrictions when your server has a static IP
• Store tokens in environment variables, never in source code
• Rotate tokens periodically and revoke unused tokens

Create an application token

To create an application_token, send a POST request to /api/v1/application_token.

1
import requests
2
3
url = "https://cdn.emnify.net/api/v1/application_token"
4
5
payload = {
6
    "description": "Token with expiry date",
7
    "expiry_date": "2021-05-29T00:00:00.000Z"
8
}
9
headers = {
10
    "Authorization": "Bearer <token>",
11
    "Content-Type": "application/json"
12
}
13
14
response = requests.post(url, json=payload, headers=headers)
15
16
print(response.json())

1
{
2
  "application_token": "KAOp24TuMgjO2FpZmZ3ZFjSqpk7ea_mY8H2daMlMXF-lRbmMzLeQwSEX67-NFczI3GgHcHpCKTfAw"
3
}

You can revoke the application token at any time.

Authenticate with an application token

Once you create an application token, use /api/v1/authenticate to generate a JWT auth_token that authenticates subsequent API calls.

1
import requests
2
3
url = "https://cdn.emnify.net/api/v1/authenticate"
4
5
payload = { "application_token": "5cCI6IkpXVCJ9.." }
6
headers = {"Content-Type": "application/json"}
7
8
response = requests.post(url, json=payload, headers=headers)
9
10
print(response.json())

1
{
2
  "auth_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
3
}

Handle token expiration

When an application token expires or is revoked:

• Any auth_token generated from it remains valid until its own expiration
• New authentication attempts with the expired application token fail with a 401 Unauthorized error
• You need to create a new application token and update your application configuration

To avoid service interruptions:

1. Set up monitoring for authentication failures
2. Create a new application token before the current one expires
3. Update your application to use the new token
4. Revoke the old token after the transition is complete

Use an SDK

If you prefer to use an SDK instead of direct API calls:

• Python SDK Quickstart
• Java SDK Quickstart