# Generate a token (/core/embed/authentication/how-to/authentication-and-tokens)





<CalloutContainer type="info">
  <CalloutDescription>
    **Target Audience**: Developers & Non technical users
  </CalloutDescription>
</CalloutContainer>

### Goal [#goal]

Generate a temporary authentication token to authorize an embedded dashboard or the AI assistant in a development environment.

***

### Prerequisites [#prerequisites]

* A [Toucan AI account](/core/getting-started/quick-start/subscribe-to-toucan) with active access.
* A [valid API key](/core/embed/authentication/how-to/generate-an-api-key).
* Access to the platform's security and embed settings.

***

### Steps [#steps]

#### 1. Access embed settings [#1-access-embed-settings]

* Click on the **Settings** button in the main menu.
* Select the **Embed & access** tab to access the token management interface.

#### 2. Configure authorized origins [#2-configure-authorized-origins]

* Navigate to the **Authorized Origins** section.
* Define the specific URLs (domains) where Toucan AI components are permitted to render.
* Toucan AI will reject requests and tokens used on domains not listed in this section.

#### 3. Define token attributes [#3-define-token-attributes]

* Review the **Token Attributes** section to see default identity fields like `distinctId` and `role`.
* Add any custom attributes (e.g., `location`, `department`) required to test Row-Level Security (RLS) filters.

#### 4. Generate a sandbox token [#4-generate-a-sandbox-token]

* Scroll to the **Token Generation Sandbox** section.
* Paste your API key into the designated field.
* Click **Generate Token** to create a signed credential.
* **Validity**: By default, sandbox tokens remain valid for **1 hour**.

<img alt="Token Generation" src="__img0" />

#### 5. Verify and inspect [#5-verify-and-inspect]

* Copy the generated token for use in your embed code.
* **Token Introspection**: If you need to verify the payload, use the **Token Introspection** section to view the encoded attributes and expiration timestamp.

***

#### Token functionality [#token-functionality]

The generated token facilitates the following during an embedded session:

* **Secure Handshake**: Authenticates the component without exposing your master API key.
* **Data Scoping**: Automatically applies RLS rules based on the attributes contained in the token payload.

***

### Conclusion [#conclusion]

You have generated a temporary token for testing purposes. While this sandbox token is suitable for development, production environments require your backend to generate these tokens dynamically via the API.

**Suggested Next Step**: [How-to: Embed a dashboard](/core/embed/embedding-overview/how-to/embed-a-dashboard) or [How-to: Configure Row-Level Security (RLS)](/core/embed/permissions-and-row-level-security/how-to/apply-rls-to-your-database)