# Secure authentication with tokens (/en/realtime-media/im/build/secure-access-and-authentication/authentication/flutter)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

Agora uses digital tokens to authenticate users and their privileges before they access Agora Chat. For test purposes, you can generate temporary tokens in Agora Console.
    See [Manage users and generate tokens](../../get-started/enable#manage-users-and-generate-tokens) for details.

    In a development environment, you deploy your own app server to generate authentication tokens. This page introduces how to set up a token server, retrieve tokens from your server, and  authenticate your users.

    ## Understand the tech [#understand-the-tech-3]

    Agora Chat employs two types of tokens for authentication:

    * Use tokens with app privileges to call Agora RESTful APIs.

      ![Chat app token authentication flow](https://assets-docs.agora.io/images/im/chat-app-token.svg)

    * Use tokens with user privileges for user authentication and interaction through the Agora Chat SDK.

      ![Chat user token authentication flow](https://assets-docs.agora.io/images/im/chat-user-token.svg)

    | Use-case          | Token type                 | Information required to generate                                                                                                                   | Maximum validity |
    | :---------------- | :------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------- |
    | RESTful API calls | Token with app privileges  | App ID of your Agora Chat projectApp certificate of your Agora Chat projectToken validity period for your Agora Chat project                       | 24 hours         |
    | SDK API calls     | Token with user privileges | App ID of your Agora Chat projectApp certificate of your Agora Chat projectToken validity period for your Agora Chat projectThe Agora Chat user ID | 24 hours         |

    ## Prerequisites [#prerequisites-3]

    In order to follow this procedure, you must have the following:

    * A valid [Agora account](/en/realtime-media/im/get-started/manage-agora-account#sign-up-and-log-in).
    * An [Agora project](/en/realtime-media/im/get-started/manage-agora-account#create-and-manage-projects) with the [App Certificate](/en/realtime-media/im/get-started/manage-agora-account#manage-app-certificates) and [Agora Chat](../../get-started/enable) enabled.
    * App ID, OrgName, and AppName of your Agora project. See [Enable and Configure Agora Chat Service](../../get-started/enable).

    If you have a firewall implemented in your network environment, Agora provides a firewall whitelist solution for you to access Agora Chat in environments with restricted network access. If you want to use the firewall whitelist solution, [submit a ticket](https://agora-ticket.agora.io/) and our technical support will provide the target domain and corresponding IP.

    ## Implement the authentication flow [#implement-the-authentication-flow-3]

    <a id="use-tokens-for-user-authentication" />

    This section shows you how to supply and consume a token used to authenticate a user with Agora Chat.

    ### Deploy an app server to generate tokens [#deploy-an-app-server-to-generate-tokens-3]

    <a id="deploy-a-token-server" />

    Tokens used for connecting with Agora Chat are generated by your app server. When a client sends a request, the app server generates an appropriate token. The following figure shows how to manage tokens with app and user privileges to facilitate secure user authentication and interaction with Agora Chat services.

    Token generation API call sequence

    ![token\_generate\_user\_token](https://assets-docs.agora.io/images/im/chat-token-api.svg)

    This section guides you through setting up a token server. Choose your preferred language and follow the step-by-step procedure.

    <CalloutContainer type="warning">
      <CalloutDescription>
        This sample server code provided in this guide is for demonstration purposes only. Do not use it directly in a production environment.
      </CalloutDescription>
    </CalloutContainer>

    ### Chat SDK token authentication [#chat-sdk-token-authentication-3]

    The following code fetches and replaces an expired token for the Agora Chat SDK. It performs the following tasks:

    1. Fetches a fresh token on app startup\*
       At the start of the application, it fetches a valid token for the user from a token server.

    2. **Listens for `onTokenWillExpire` event**:
       The app sets up a listener to monitor when the token is about to expire. Upon receiving this event, it fetches a new token from the token server and renews the token with the Agora Chat SDK. Since SDK v1.4.0, the SDK triggers this event when 80% of the token's validity period has elapsed (previously 50%).

    ## Reference [#reference-3]

    This section introduces token generator libraries, version requirements, and related documents about tokens.

    ### Token generator libraries [#token-generator-libraries-3]

    For more examples and source code in other development languages, explore the [AgoraDynamicKey](https://github.com/AgoraIO/Tools/tree/master/DynamicKey/AgoraDynamicKey) open-source repository on GitHub.

    ### Tokens for Agora RTC products [#tokens-for-agora-rtc-products-3]

    If you use Agora Chat together with the [Agora RTC SDK](/en/realtime-media/video/core-concepts), Agora recommends upgrading to [AccessToken 2](/en/realtime-media/im/build/secure-access-and-authentication/access-token-2).