---
title: JWT token login
description: GET /account/tokenLogin.do: JWT token login interface description, including path, method, parameters and return information.
slug: api-get-account-tokenlogin-do
lang: en
category: Messages And Login API
category_order: 8
order: 158
api_method: GET
api_path: /account/tokenLogin.do
api_label: JWT token login
keywords:
  - API
  - JWT token login
  - /account/tokenLogin.do
---


# JWT Web Login

`GET /account/tokenLogin.do`

Opens the web drive as an identified user in a private deployment with JWT login enabled. It establishes a web session, not a business API access_token.

## URL Query Parameters

| Parameter | Requirement and meaning |
| --- | --- |
| `userToken` | Required signed JWT from a trusted server |
| `fileId` | Optional target file/folder; otherwise opens the user's root |
| `closeTitleBar` | 1 hides the title bar; default 0 |
| `disableEntMark` | 1 hides the enterprise mark; default 0 |
| `disableUserMark` | 1 hides the user settings entry; default 0 |
| `defaultLang` | cn, en or zh-HK; default cn |
| `defaultClrTheme` | normal or dark; default normal |

```text
/account/tokenLogin.do?userToken=<JWT_TOKEN>&defaultLang=en&defaultClrTheme=dark
```

## Identity and Security

The source login payload uses `payload.email` for an agreed email, phone or employee identifier, with the issue time. Match the claims and validity to server configuration; see the [JWT example](developer-api-overview.md).

Signing authenticates the JWT but does not encrypt its payload. Generate short-lived credentials only on a trusted server, use HTTPS and control URL logging. Validate the caller's authority to act for the target user.

Hiding UI elements does not grant permissions and does not replace access control.