> For the complete documentation index, see [llms.txt](https://docs.sensecrypt.com/sensecrypt-v3.1.1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sensecrypt.com/sensecrypt-v3.1.1/sensecrypt-server/using-a-jwt-token-for-mobile-authorization.md).

# Using a JWT Token for Mobile Authorization

Implement your own authorization mechanism for API access for online mobile SDKs

While the value of `mobile_api_key` you set in your `secrets.json` in the [Configuration](/sensecrypt-v3.1.1/sensecrypt-server/configuration.md) section provides a convenient way of authorizing requests to the server for mobile SDKs, at some point you might need to authorize users based on your own needs before they can access the SenseCrypt server APIs.

In another scenario, you might not wish to expose your `mobile_api_key` as a hard coded configuration parameter in your code and, instead, would prefer to authorize user's based on your own needs.

A JSON Web Token (JWT) provides a convenient mechanism to address these scenarios.

In the example below, it is assumed you have already authorized yourself using you `api_key` as was shown in the [previous section](/sensecrypt-v3.1.1/sensecrypt-server/authorization.md).

To generate a JWT, expand the `/gen-jwt` section and then click the `Try it out` button as shown below:

<figure><img src="https://content.gitbook.com/content/Js24ubSW0t5sCQDrQHme/blobs/3eTqyDSLQjoiP8GRPVDw/generate-jwt-token.png" alt=""><figcaption><p>Generating a JWT token</p></figcaption></figure>

This will enable the following data to be editable:

```json
{
  "instance_id": "123445"
}
```

The instance\_id can be used to [generate JWT tokens for a particular mobile device](/sensecrypt-v3.1.1/sensecrypt-mobile-sdks/authorization-for-online-sdks.md) (the mobile SDKs provide a mechanism to get the ID for a device, this device ID should be used as a value for the `instance_id` parameter).&#x20;

If you need a generic JWT which is not bound to a device, you can use an empty body as shown below.&#x20;

While this will work, it is recommended that you generate tokens for specific devices for better security.

```json
{
}
```

The API call returns the JWT token. Now you can initialize the online mobile SDKs with the value `Bearer your_jwt_token` instead of using the `mobile_api_key` for auth.

By default the lifetime of JWT tokens is 5 mins. You can [change this](/sensecrypt-v3.1.1/sensecrypt-server/configuration.md) by changing the configured value of `jwt_expire_seconds` in your server's configuration.&#x20;

For better security, you can also change the value of `jwt_secret` to some value that only you know.&#x20;