Generate session token

Mint a SafetyKit session token on your own backend using a signing key issued by SafetyKit, without calling the SafetyKit API. Use this when your mobile app needs a session token — mint it server-side while handling login, registration, or token-fetch requests, and return it to the app to pass to the SafetyKit SDK. The signing key must stay on your server: it has the same sensitivity as an API key and must never ship inside an app.

Minting is currently supported in the Kotlin SDK only; support in other SDK languages is planned. This capability is in limited availability — contact support@safetykit.com to have a signing key pair issued for your team.

Installation

dependencies {
    implementation("com.safetykit:safetykit-kotlin:0.4.0")
}

Usage

import com.safetykit.lib.SessionTokens

val sessionToken =
    SessionTokens.mint(
        kid = System.getenv("SAFETYKIT_SESSION_KID"),
        key = System.getenv("SAFETYKIT_SESSION_KEY"),
        teamId = SAFETYKIT_TEAM_ID,
        customerUserId = user.id,
        customerSessionHash = sessionHash,
    )

Returns an opaque, client-safe token string. Mint a fresh token per session; do not reuse tokens across sessions.

Parameters

Parameter	Type	Required	Description
kid	String	Yes	Key ID from your SafetyKit-issued pair (sk_test_… or sk_live_…). Not secret; appears in plaintext in every token.
key	String	Yes	Signing secret from the same pair. Keep it in your server-side secret store.
teamId	String	Yes	Your SafetyKit team ID.
customerUserId	String	At least one of these two	The same canonical user ID string you send as user_id in SafetyKit server-to-server events.
customerSessionHash	String	At least one of these two	A stable opaque identifier or hash for your session — for example a SHA-256 of your session ID. Never send a raw session or cookie value.
clock	Clock	No (defaults to system clock)	Overrides the issued-at timestamp source; intended for tests.

The session ID inside the token and the issued-at timestamp are generated by the SDK. mint throws IllegalArgumentException when required parameters are missing or malformed, and cannot fail transiently — there is no network call.

Key pairs

SafetyKit issues a kid/key pair per environment: use the sk_test_ pair for test traffic and the sk_live_ pair for production. Always mint with the kid and key from the same pair. If a key is exposed, contact SafetyKit to revoke it — a replacement pair can be active before the old one is revoked, so rotation requires no downtime.