diff --git a/include/toksvc/toksvc.h b/include/toksvc/toksvc.h
index 7e7128d..51ec884 100644
--- a/include/toksvc/toksvc.h
+++ b/include/toksvc/toksvc.h
@@ -81,6 +81,10 @@ struct toks_source_version {
 	const char *	commit;
 };
 
+struct toks_token_string{
+	char            token[128];
+};
+
 struct toks_error_info {
 	const struct toks_driver_ctx *	edctx;
 	const struct toks_unit_ctx *	euctx;
@@ -124,6 +128,8 @@ toks_api void toks_free_driver_ctx      (struct toks_driver_ctx *);
 /* client api */
 toks_api int  toks_client_connect       (struct toks_driver_ctx *);
 toks_api int  toks_client_acquire       (struct toks_driver_ctx *);
+toks_api int  toks_client_token_to_str  (struct toks_driver_ctx *, struct toks_token_string *);
+toks_api int  toks_client_str_to_token  (struct toks_driver_ctx *, const struct toks_token_string *);
 
 /* utility api */
 toks_api int  toks_main                 (char **, char **);
diff --git a/project/common.mk b/project/common.mk
index c4c5132..0ec9d59 100644
--- a/project/common.mk
+++ b/project/common.mk
@@ -4,6 +4,7 @@ INTERNAL_SRCS = \
 	src/client/toks_client_acquire.c \
 	src/client/toks_client_connect.c \
 	src/client/toks_client_release.c \
+	src/client/toks_client_token.c \
 	src/daemon/toks_daemon_acquire.c \
 	src/daemon/toks_daemon_connect.c \
 	src/daemon/toks_daemon_init.c \
diff --git a/src/client/toks_client_token.c b/src/client/toks_client_token.c
new file mode 100644
index 0000000..359a3b1
--- /dev/null
+++ b/src/client/toks_client_token.c
@@ -0,0 +1,87 @@
+/*********************************************************/
+/*  toksvc: a framework-native token broker service      */
+/*  Copyright (C) 2020  Z. Gilboa                        */
+/*  Released under GPLv2 and GPLv3; see COPYING.TOKSVC.  */
+/*********************************************************/
+
+#include <psxtypes/psxtypes.h>
+#include <ntapi/ntapi.h>
+
+#include <toksvc/toksvc.h>
+#include "toksvc_driver_impl.h"
+
+int32_t toks_client_token_to_str(
+	struct toks_driver_ctx *        dctx,
+	struct toks_token_string *      toks)
+{
+	struct _nt_port_keys *	keys;
+	unsigned char *		uch;
+
+	keys = toks_get_driver_keys(dctx);
+	uch  = (unsigned char *)toks->token;
+
+	ntapi->tt_generic_memset(
+		toks->token,0,
+		sizeof(toks->token));
+
+	uch[8]  = '-';
+	uch[17] = '-';
+	uch[26] = '-';
+	uch[35] = '-';
+	uch[44] = '-';
+
+	ntapi->tt_uint32_to_hex_utf8(keys->key[0],&uch[0]);
+	ntapi->tt_uint32_to_hex_utf8(keys->key[1],&uch[9]);
+	ntapi->tt_uint32_to_hex_utf8(keys->key[2],&uch[18]);
+	ntapi->tt_uint32_to_hex_utf8(keys->key[3],&uch[27]);
+	ntapi->tt_uint32_to_hex_utf8(keys->key[4],&uch[36]);
+	ntapi->tt_uint32_to_hex_utf8(keys->key[5],&uch[45]);
+
+	return NT_STATUS_SUCCESS;
+}
+
+int32_t toks_client_str_to_token(
+	struct toks_driver_ctx *            dctx,
+	const struct toks_token_string *    toks)
+{
+	struct _nt_port_keys *	keys;
+	unsigned char *		uch;
+	uint32_t		key[6];
+
+	keys = toks_get_driver_keys(dctx);
+	uch  = (unsigned char *)toks->token;
+
+	if ((uch[8] != '-') || (uch[17] != '-') || (uch[26] != '-')
+		|| (uch[35] != '-') || (uch[44] != '-'))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (ntapi->tt_hex_utf8_to_uint32(&uch[0],&key[0]))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (ntapi->tt_hex_utf8_to_uint32(&uch[9],&key[1]))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (ntapi->tt_hex_utf8_to_uint32(&uch[18],&key[2]))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (ntapi->tt_hex_utf8_to_uint32(&uch[27],&key[3]))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (ntapi->tt_hex_utf8_to_uint32(&uch[36],&key[4]))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (ntapi->tt_hex_utf8_to_uint32(&uch[45],&key[5]))
+		return NT_STATUS_INVALID_PARAMETER;
+
+	if (uch[53])
+		return NT_STATUS_INVALID_PARAMETER;
+
+	keys->key[0] = key[0];
+	keys->key[1] = key[1];
+	keys->key[2] = key[2];
+	keys->key[3] = key[3];
+	keys->key[4] = key[4];
+	keys->key[5] = key[5];
+
+	return NT_STATUS_SUCCESS;
+}