Dynamic, personalized email content often requires authenticating the user.
However, to protect user data, all HTTP requests made from inside AMP emails
within Gmail are proxied and stripped of cookies.

To authenticate requests made from AMP emails, use
[access tokens](https://developers.google.com/workspace/gmail/ampemail/authenticating-requests#access_tokens).

## Access tokens

You can use access tokens to authenticate the user. Access tokens are
supplied and checked by the email sender. The sender uses the tokens to ensure
that only those with access to the AMP email can make the requests contained
within that email. Access tokens must be cryptographically secure and time- and
scope-limited. They are included within the URL of the request.

This example demonstrates using `<amp-list>` to display authenticated data:

    <amp-list src="https://example.com/endpoint?token=REPLACE_WITH_YOUR_ACCESS_TOKEN"
      height="300">
      <template type="amp-mustache">
        ...
      </template>
    </amp-list>

Similarly, when using `<amp-form>`, place your access token in the `action-xhr`
URL.

    <form action-xhr="https://example.com/endpoint?token=REPLACE_WITH_YOUR_ACCESS_TOKEN" method="post">
      <input type="text" name="data">
      <input type="submit" value="Send">
    </form>

> [!NOTE]
> **Note:** Email clients typically strip the AMP MIME part on reply or forward. Also, Gmail only considers an AMP part to be usable for 30 days after it is received, so set the lifetime of your access token to 31 days.

### Example

The following example considers a hypothetical note-taking service that lets
logged-in users add notes to their account and view them later. The service
wants to send an email to a user, `jane@example.com`, that includes a list of
notes they previously took. The list of the current user's notes is available
at the endpoint `https://example.com/personal-notes` in JSON format.

Before sending the email, the service generates a cryptographically secure
limited-use access token for `jane@example.com`: `A3a4roX9x`. The access token is
included in the parameter `exampletoken` inside the URL query:

    <amp-list src="https://example.com/personal-notes?exampletoken=A3a4roX9x" height="300">
      <template type="amp-mustache">
        <p>{{note}}</p>
      </template>
    </amp-list>

The endpoint `https://example.com/personal-notes` is responsible for validating
the `exampletoken` parameter and finding the user associated with the token.

For more information, see
[Limited use access tokens](https://developers.google.com/workspace/gmail/markup/actions/limited-use-access-tokens).

> [!NOTE]
> **Note:** A conventional web application could query the user notes endpoint with an XMLHttpRequest (XHR), and a cookie could provide the endpoint with the user's identity. In AMP for Email, however, this approach doesn't work because all HTTP requests are anonymized in Gmail AMP emails. Instead, AMP must identify the user in the URL itself.