Skip to main content
Generating tenant tokens without a library is possible, but not recommended. This guide summarizes the necessary steps. The full process requires you to create a token header, prepare the data payload with at least one set of search rules, and then sign the token with an API key.

​
Prepare token header

The token header must specify a JWT type and an encryption algorithm. Supported tenant token encryption algorithms are HS256, HS384, and HS512. 
{
  "alg": "HS256",
  "typ": "JWT"
}

​
Build token payload

First, create a set of search rules: 
{
  "INDEX_NAME": {
    "filter": "ATTRIBUTE = VALUE"
  }
}
Next, find your default search API key. Query the get API keys endpoint and inspect the uid field to obtain your API key’s UID: 
curl \
  -X GET 'MEILISEARCH_URL/keys' \
  -H 'Authorization: Bearer MASTER_KEY'
For maximum security, you should also set an expiry date for your tenant tokens. The following Node.js example configures the token to expire 20 minutes after its creation: 
parseInt(Date.now() / 1000) + 20 * 60
Lastly, assemble all parts of the payload in a single object: 
{
  "exp": UNIX_TIMESTAMP,
  "apiKeyUid": "API_KEY_UID",
  "searchRules": {
    "INDEX_NAME": {
      "filter": "ATTRIBUTE = VALUE"
    }
  }
}
Consult the token payload reference for more information on the requirements for each payload field.

​
Encode header and payload

You must then encode both the header and the payload into base64, concatenate them, and generate the token by signing it using your chosen encryption algorithm.

​
Make a search request using a tenant token

After signing the token, you can use it to make search queries in the same way you would use an API key. 
curl \
  -X POST 'MEILISEARCH_URL/indexes/patient_medical_records/search' \
  -H 'Authorization: Bearer TENANT_TOKEN'

​
Next steps

Tenant token payload reference

Detailed reference for all fields in the tenant token payload.

Generate tokens with an SDK

Use a Meilisearch SDK to generate tenant tokens with less manual work.

Generate tokens with a third-party library

Create tenant tokens using JWT libraries like jsonwebtoken.