---
title: "Issue access and refresh tokens"
method: POST
path: "/auth/token"
---

# Issue access and refresh tokens

`POST /auth/token`

## Request body

- object
  - `number` string, required
  - `password` string, required

## Response `200`

Auth tokens

- SuccessEnvelope
  - `data` unknown, required
  - `meta` ResponseMeta, required
    - `requestId` string, required
    - `timestamp` string, date-time, required

## Other responses

- `400` — Problem details response
- `401` — Problem details response
- `403` — Returned by authenticated endpoints when the caller is authenticated but not permitted to use the API yet. Two stable extension codes can appear: - `email_unconfirmed`: the account still has a pending email confirmation (a `registration` token row). Enforced per request on the `api_v1` firewall via the same `UserChecker` as web login, so a token issued before the account lapsed stops working immediately. Resolve out-of-band via the email confirmation link. - `phone_unconfirmed`: the SMS system is enabled and the caller's phone number is not yet confirmed. The caller holds ROLE_NEWBIE and must confirm their phone first (see the phone-confirmation routes). Both are standard Problem Details responses; clients should branch on the `code` extension rather than the human-readable `detail`.

---

[API](https://skmtc.net/cyklokoalicia/apis/opensourcebikeshare-api.md) · [All operations](https://skmtc.net/cyklokoalicia/apis/opensourcebikeshare-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cyklokoalicia/opensourcebikeshare-api/versions/5acb23b38232/schema)