diff --git a/server/express/api/devices.ts b/server/express/api/devices.ts
index ea83a84..4163b1a 100644
--- a/server/express/api/devices.ts
+++ b/server/express/api/devices.ts
@@ -1,3 +1,4 @@
+import { Request } from "express";
 import PromiseRouter from "express-promise-router";
 import { serialize } from "serializr";
 
@@ -5,6 +6,7 @@ import ApiError from "@common/ApiError";
 import { ErrorCode } from "@common/ErrorCode";
 import * as schema from "@common/sprinklersRpc/schema";
 import { generateDeviceToken } from "@server/authentication";
+import { SprinklersDevice } from "@server/entities";
 import { verifyAuthorization } from "@server/express/verifyAuthorization";
 import { ServerState } from "@server/state";
 
@@ -30,7 +32,7 @@ function randomDeviceId(): string {
 export function devices(state: ServerState) {
   const router = PromiseRouter();
 
-  router.get("/:deviceId", verifyAuthorization(), async (req, res) => {
+  async function verifyUserDevice(req: Request): Promise<SprinklersDevice> {
     const token = req.token!;
     const userId = token.aud;
     const deviceId = req.params.deviceId;
@@ -44,12 +46,32 @@ export function devices(state: ServerState) {
         ErrorCode.NoPermission
       );
     }
+    return userDevice;
+  }
+
+  router.get("/:deviceId", verifyAuthorization(), async (req, res) => {
+    await verifyUserDevice(req);
     const device = state.mqttClient.acquireDevice(req.params.deviceId);
     const j = serialize(schema.sprinklersDevice, device);
     res.send(j);
     device.release();
   });
 
+  router.post("/:deviceId/generate_token",
+    verifyAuthorization(), async (req, res) => {
+      const device = await verifyUserDevice(req);
+      if (!device.deviceId) {
+        throw new ApiError(
+          "A token cannot be granted for a device with no id",
+          ErrorCode.BadRequest,
+        )
+      }
+      const token = await generateDeviceToken(device.id, device.deviceId);
+      res.send({
+        token,
+      });
+    });
+
   router.post(
     "/register",
     verifyAuthorization({