---
title: 'Tutorial: Create Token URLs Using the Web API'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--token-urls-via-the-web-api/
product: Access Server Docs
description: Create token URLs using the OpenVPN Access Server Web API. Generate secure links that allow users to download and import user-locked, auto-login, server-locked, and ePKI connection profiles into OpenVPN Connect.
---

# Tutorial: Create Token URLs Using the Web API

## Overview

This tutorial shows how to create [token URLs](https://openvpn.net/as-docs/v3/token-url.md) using the Access Server Web API.

A token URL provides a secure, temporary link that allows users to download and import a connection profile directly into OpenVPN Connect. This can simplify profile distribution and onboarding by eliminating the need to manually download and import profile files.

> **Tip**
>
> This tutorial uses the `sacli apicall` command, but you can also use cURL or the Swagger UI. Refer to [Tutorial: Test the New Web API (OpenAPI) in Access Server 3.0](https://openvpn.net/as-docs/v3/tutorials/tutorial--test-the-new-web-api--openapi--in-access-server-3-0.md).

## Prerequisites

- Access Server 3.1.0 or newer.
- Root privileges on your Access Server's console.
- (Optional) A remote machine for running API calls.

> **Important**
>
> The API specification can change between Access Server versions. Verify the API specification for your version before using these commands.
>
> Refer to: [Tutorial: Test the New Web API (OpenAPI) in Access Server 3.0](https://openvpn.net/as-docs/v3/tutorials/tutorial--test-the-new-web-api--openapi--in-access-server-3-0.md).

## Step 1: Generate a token URL

1. Connect to the console and get root privileges.
2. Run one of the following commands based on the profile type you want to generate.

### User-locked profile

```
sacli --method POST --url 'api/token-url' --value '{"profile_type":"userlogin", "username": "<USER_NAME>"}' apicall
```

### Auto-login profile

```
sacli --method POST --url 'api/token-url' --value '{"profile_type":"autologin", "username": "<USER_NAME>"}' apicall
```

> **Important**
>
> Auto-login profiles require the user to have auto-login permission, either assigned directly or inherited through a group. By default, auto-login permission is disabled.

### Server-locked profile

```
sacli --method POST --url 'api/token-url' --value '{"profile_type":"generic", "username": "<USER_NAME>"}' apicall
```

### Generic ePKI profile

```
sacli --method POST --url 'api/token-url' --value '{"profile_type":"epki-generic", "username": "<USER_NAME>"}' apicall
```

> **Note**
>
> ePKI profile types can only be used when Access Server is configured for [ePKI mode](https://openvpn.net/as-docs/v3/external-public-key-infrastructure.md).

### Auto-login ePKI profile

```
sacli --method POST --url 'api/token-url' --value '{"profile_type":"epki-autologin", "username": "<USER_NAME>"}' apicall
```

> **Note**
>
> ePKI profile types can only be used when Access Server is configured for [ePKI mode](https://openvpn.net/as-docs/v3/external-public-key-infrastructure.md).

## Result

The API returns a token URL similar to the following:

```
"openvpn://import-profile/https://192.0.2.2/rest/GetProfileViaToken?token=Q3nY2St5T9jMHUAcX9aDUPPvDIzamD6s"
```

Open the URL on a device with OpenVPN Connect installed to automatically import the connection profile.

The imported profile type matches the option selected when generating the token URL.

## Related tutorials

- [Tutorial: Test the New Web API (OpenAPI) in Access Server 3.0](https://openvpn.net/as-docs/v3/tutorials/tutorial--test-the-new-web-api--openapi--in-access-server-3-0.md)
- [Tutorial: Create a Token URL in the Admin Web UI](https://openvpn.net/as-docs/v3/tutorials/tutorial--token-url-admin-web-ui.md)
- [Tutorial: Manage Token URLs from the Command-Line Interface](https://openvpn.net/as-docs/v3/tutorials/tutorial--token-url-cli.md)
- [Tutorial: Create Connection Profiles Using the Web API (OpenAPI)](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-connection-profiles-with-web-api.md)
- [Tutorial: Create OpenVPN Connect Bundled Installers](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-openvpn-connect-installers.md)
- [Tutorial: Create OpenVPN Connect Bundled Client Installers Using the Web API](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-bundled-client-installers-via-api.md)

---

Prev: [Tutorial: Manage Token URLs from the Command-Line Interface](https://openvpn.net/as-docs/v3/tutorials/tutorial--token-url-cli.md)
Next: [Tutorial: Manually Download a Connection Profile Using a Token URL](https://openvpn.net/as-docs/v3/tutorials/tutorial--manual-download-token-url.md)
Index: https://openvpn.net/as-docs/llms.txt