> ## Documentation Index
> Fetch the complete documentation index at: https://www.ayrshare.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a Linking URL (generateJWT)

> Create a social-linking URL for a User Profile with the generateJWT endpoint.

export const PlansAvailable = ({plans = [], maxPackRequired}) => {
  let displayPlans = plans;
  if (plans && plans.length === 1) {
    const lowerCasePlan = plans[0].toLowerCase();
    if (lowerCasePlan === "business") {
      displayPlans = ["Launch", "Business", "Enterprise"];
    } else if (lowerCasePlan === "premium") {
      displayPlans = ["Premium", "Launch", "Business", "Enterprise"];
    }
  }
  return <Note>
Available on {displayPlans.length === 1 ? "the " : ""}
{displayPlans.join(", ").replace(/\b\w/g, l => l.toUpperCase())}{" "}
{displayPlans.length > 1 ? "plans" : "plan"}.

{maxPackRequired && <span onClick={() => window.open('https://www.ayrshare.com/docs/additional/maxpack', '_self')} className="flex items-center mt-2 cursor-pointer">
 <span className="px-1.5 py-0.5 rounded text-sm" style={{
    backgroundColor: '#C264B6',
    color: 'white',
    fontSize: '12px'
  }}>
   Max Pack required
 </span>
</span>}
</Note>;
};

export const HeaderAPI = ({noProfileKey, profileKeyRequired}) => <>
    <ParamField header="Authorization" type="string" required>
      <a href="/docs/apis/overview#authorization">API Key</a> of the Primary Profile.
      <br />
      <br />
      Format: <code>Authorization: Bearer API_KEY</code>
    </ParamField>
    {!noProfileKey && (profileKeyRequired ? <ParamField header="Profile-Key" type="string" required>
          <a href="/docs/apis/overview#profile-key-format">Profile Key</a> of a User Profile.
          <br />
          <br />
          Format: <code>Profile-Key: PROFILE_KEY</code>
        </ParamField> : <ParamField header="Profile-Key" type="string">
          <a href="/docs/apis/overview#profile-key-format">Profile Key</a> of a User Profile.
          <br />
          <br />
          Format: <code>Profile-Key: PROFILE_KEY</code>
        </ParamField>)}
  </>;

<PlansAvailable plans={["business"]} maxPackRequired={false} />

Create a social-linking URL for a User Profile. The endpoint is still named `generateJWT`, but the token it returns is opaque and is not a JWT.

See the [Social Linking Overview](/docs/apis/profiles/social-linking-overview) for more details.

<Note>
  The linking URL is valid for **5 minutes**. After 5 minutes you must generate a new linking URL.
  See the Max Pack `expiresIn` for [additional options](/docs/apis/profiles/social-linking-overview#jwt-expires-in).
</Note>

<Info>
  **This endpoint is deprecated.** It is fully supported, has no removal date, and keeps working
  unchanged — it is simply no longer the recommended way to create a linking URL.

  The returned `token` is an **opaque string** beginning `ayr_ls_` — it is not a
  decodable JWT and carries no readable payload. Pass the `url` to your user as
  returned, and treat `token` as a credential you store rather than inspect.
  Links you created earlier still work.

  `POST /profiles/link-sessions` is the same operation without the legacy
  parameters, and it also lets you check or revoke a link. See
  [Create a Link Session](/docs/apis/profiles/create-link-session).
</Info>

## Header Parameters

<HeaderAPI noProfileKey />

<ParamField header="X-Twitter-OAuth1-Api-Key" type="string">
  Your X API Key (Consumer Key) from the X Developer Portal. Alternative to the `twitterApiKey` body parameter. When provided, the generated linking URL will use your X Developer App for OAuth linking.
</ParamField>

<ParamField header="X-Twitter-OAuth1-Api-Secret" type="string">
  Your X API Secret (Consumer Secret) from the X Developer Portal. Alternative to the `twitterApiSecret` body parameter. Required when `X-Twitter-OAuth1-Api-Key` is provided.
</ParamField>

<Info>
  **Recommended:** Pass your X credentials via headers (`X-Twitter-OAuth1-Api-Key` and `X-Twitter-OAuth1-Api-Secret`) for consistency with all other Ayrshare API endpoints. The `twitterApiKey` and `twitterApiSecret` body parameters are still supported for backward compatibility.
</Info>

## Body Parameters

<ParamField body="domain" type="string">
  Domain of app. Please use the exact domain given during onboarding.

  Optional. When omitted, your account's own domain is used. If you do send it, it must be a domain registered to your account.
</ParamField>

<ParamField body="privateKey" type="string" deprecated>
  No longer used. Accepted and ignored, so existing integrations keep working without a change.

  Linking URLs are no longer signed, so there is no key to send. You can remove this field, and stop storing the private key for this purpose.
</ParamField>

<ParamField body="profileKey" type="string" required>
  User Profile Key. The API Key cannot be used in this field.
</ParamField>

<ParamField body="logout" type="boolean" default={false}>
  Automatically logout the current session. Recommend not to use in production since it affects the performance.

  See [Automatic Logout of a Profile Session](/docs/multiple-users/api-integration-business#automatic-logout-of-a-profile-session) for more information.
</ParamField>

<ParamField body="redirect" type="string">
  Specify a URL to redirect to when the "Done" button or logo image is clicked. The URL will be automatically shortened in the returned linking URL. [Redirect the origin ](/docs/multiple-users/api-integration-business#opening-&-closing-the-social-linking-url)opener window by adding the query parameter `origin=true` to the redirect URL.
</ParamField>

<ParamField body="allowedSocial" type="array">
  Specify the social networks to display in the linking page. This will override the social networks configured in the [Social Networks](/docs/multiple-users/manage-user-profiles#set-social-networks-access) page.

  ```json Only display Facebook, X/Twitter, LinkedIn, and TikTok theme={"system"}
  {
    "allowedSocial": ["facebook", "twitter", "linkedin", "tiktok"]
  }
  ```
</ParamField>

<ParamField body="instagramLinkMethod" type="string">
  Override which Instagram linking flow is used when a user clicks the Instagram button on the social linking page for this URL. Valid values:

  * `instagram`: Direct Instagram Login, no Facebook Page required.
  * `facebook`: Link Instagram via a connected Facebook Page.

  ```json Force direct Instagram Login for this linking session theme={"system"}
  {
    "instagramLinkMethod": "instagram"
  }
  ```

  When omitted, the linking page uses your account-wide [Instagram Login](/docs/multiple-users/manage-user-profiles#instagram-login) setting.

  See [Instagram Link Method](/docs/apis/profiles/social-linking-overview#instagram-link-method) for more information.
</ParamField>

<ParamField body="verify" type="boolean" deprecated>
  No longer used. Accepted and ignored.

  There is no signed token to verify — the returned `token` is validated by the linking page when your user opens the URL.
</ParamField>

<ParamField body="base64" type="boolean" deprecated>
  No longer used. Accepted and ignored, since `privateKey` is no longer read.
</ParamField>

<ParamField body="expiresIn" type="number" default={5}>
  Set the longevity of the token in minutes. Range: 1 minute to 2880 minutes.

  See [Link Expiry](/docs/apis/profiles/social-linking-overview#jwt-expires-in) for more information.
</ParamField>

<ParamField body="email" type="object">
  Send a Connect Accounts email with a link for users to directly access their social linkage page.

  See [Connect Accounts Email](/docs/apis/profiles/social-linking-overview#connect-accounts-email) for more information.
</ParamField>

<Info>
  When you include your X API credentials, the generated linking URL will initiate OAuth linking using your own X Developer App. Your end-users will see your app name on the X consent screen.
</Info>

<Warning>
  **Required:** Before using this feature, you must add these callback URLs to your X Developer App settings (under Authentication settings > Callback URI / Redirect URL):

  * `https://profile.ayrshare.com/social-accounts`
  * `https://app.ayrshare.com/social-accounts`

  Without these, the OAuth flow will fail with a `403 Callback URL not approved` error.
</Warning>

<RequestExample>
  ```javascript cURL theme={"system"}
  curl \
  -H "Authorization: Bearer API_KEY" \
  -H 'Content-Type: application/json' \
  -H "X-Twitter-OAuth1-Api-Key: YOUR_CONSUMER_KEY" \
  -H "X-Twitter-OAuth1-Api-Secret: YOUR_CONSUMER_SECRET" \
  -d '{"profileKey": "PROFILE_KEY"}' \
  -X POST https://api.ayrshare.com/api/profiles/generateJWT
  ```

  ```javascript JavaScript theme={"system"}
  const API_KEY = "API_KEY";
  const PROFILE_KEY = "PROFILE_KEY";

  fetch("https://api.ayrshare.com/api/profiles/generateJWT", {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "Authorization": `Bearer ${API_KEY}`,
          "X-Twitter-OAuth1-Api-Key": "YOUR_CONSUMER_KEY",
          "X-Twitter-OAuth1-Api-Secret": "YOUR_CONSUMER_SECRET"
        },
        body: JSON.stringify({
          profileKey: PROFILE_KEY, // required
        }),
      })
        .then((res) => res.json())
        .then((json) => console.log(json))
        .catch(console.error);
  ```

  ```python Python theme={"system"}
  import requests

  payload = {'profileKey': 'PROFILE_KEY'}
  headers = {'Content-Type': 'application/json',
          'Authorization': 'Bearer API_KEY',
          'X-Twitter-OAuth1-Api-Key': 'YOUR_CONSUMER_KEY',
          'X-Twitter-OAuth1-Api-Secret': 'YOUR_CONSUMER_SECRET'}

  r = requests.post('https://api.ayrshare.com/api/profiles/generateJWT',
      json=payload,
      headers=headers)

  print(r.json())
  ```

  ```php PHP theme={"system"}
  <?php
  require 'vendor/autoload.php';    // Composer auto-loader using Guzzle. See .../guzzlephp.org/en/stable/overview.html

  $client = new GuzzleHttp\Client();
  $res = $client->request(
      'POST',
      'https://api.ayrshare.com/api/profiles/generateJWT',
      [
          'headers' => [
              'Content-Type'  => 'application/json',
              'Authorization' => 'Bearer API_KEY'
          ],
          'json' => [
              'profileKey' => 'PROFILE_KEY', // required
          ]
      ]
  );

  echo json_encode(json_decode($res->getBody()), JSON_PRETTY_PRINT);
  ```

  ```csharp C# theme={"system"}
  using System;
  using System.Net.Http;
  using System.Text;
  using System.Threading.Tasks;
  using Newtonsoft.Json;

  namespace GenerateJWTRequest_csharp
  {
    class GenerateJWT
    {
        static async Task Main(string[] args)
        {
            string API_KEY = "API_KEY";
            string url = "https://api.ayrshare.com/api/profiles/generateJWT";

            try
            {
                var sendData = new
                {
                    profileKey = "PROFILE_KEY"
                };

                using (var client = new HttpClient())
                {
                    client.DefaultRequestHeaders.Add("Authorization", "Bearer " + API_KEY);

                    string jsonData = JsonConvert.SerializeObject(sendData);
                    var content = new StringContent(jsonData, Encoding.UTF8, "application/json");

                    HttpResponseMessage response = await client.PostAsync(url, content);
                    response.EnsureSuccessStatusCode();

                    string responseBody = await response.Content.ReadAsStringAsync();
                    Console.WriteLine(responseBody);
                }
            }
            catch (HttpRequestException e)
            {
                Console.WriteLine($"HTTP request error: {e.Message}");
            }
            catch (Exception e)
            {
                Console.WriteLine($"Unexpected error: {e.Message}");
            }
        }
    }
  }
  ```
</RequestExample>

<ResponseExample>
  ```json 200: Success theme={"system"}
  {
      "status": "success",
      "title": "User Profile Title",
      "token": "ayr_ls_kJ8mQ2vX9pLnR4tYwZ6aBcD1eFgH3iJkLmN0oPqRsTu",
      "url": "https://profile.ayrshare.com?session=ayr_ls_kJ8mQ2vX9pLnR4tYwZ6aBcD1eFgH3iJkLmN0oPqRsTu&domain=PROVIDED_DOMAIN",
      "emailSent": true,    
      "expiresIn": "5m"    
  }
  ```

  ```json 400: Domain Not Registered to Your Account theme={"system"}
  {
    "action": "JWT",
    "status": "error",
    "code": 189,
    "message": "Error generating JWT. Check the sent parameters.",
    "details": "Missing or incorrect domain."
  }
  ```

  ```json 400: Partial Twitter API Keys theme={"system"}
  {
    "action": "JWT",
    "status": "error",
    "code": 188,
    "message": "Both twitterApiKey and twitterApiSecret are required. You provided only one."
  }
  ```

  ```json 400: Duplicate X/Twitter Credentials theme={"system"}
  {
      "action": "JWT",
      "status": "error",
      "code": 434,
      "message": "X/Twitter API credentials were provided in both the request headers and the request body. Please use the headers only. See https://www.ayrshare.com/docs/apis/profiles/generate-jwt"
  }
  ```
</ResponseExample>