---
title: "Generate access token"
method: POST
path: "/authentication/token"
tags: ["Authentication"]
---

# Generate access token

`POST /authentication/token`

Authenticates with `email`/`password` and returns a JWT `idToken` to use as a Bearer token in the `Authorization` header for every other request. The token expires 60 minutes after issuance; call this endpoint again with the same credentials to obtain a new one — there is no separate refresh endpoint. If `email` or `password` is missing or malformed, the validation error response never echoes back the submitted values.

## Request body

- PostAuthenticationRequestSchema
  - `email` string, required — Email address of the Embat service user used to authenticate.
  - `password` string, required — Password of the Embat service user. Keep it secret.

## Response `200`

Successful Response

- PostAuthenticationResponseSchema
  - `idToken` string, required — JWT bearer token. Send it as `Authorization: Bearer <idToken>` on every other request. It expires 60 minutes after issuance; call this endpoint again with the same credentials to obtain a new one.

## Other responses

- `400` — The credentials could not be validated: unknown email, wrong password, disabled account, or too many failed attempts.
- `401` — The account has multi-factor authentication enabled, which this endpoint does not support.
- `422` — Validation Error
- `500` — Unexpected error. Contact support if it persists.

---

[API](https://skmtc.net/embat/apis/embat-api.md) · [All operations](https://skmtc.net/embat/apis/embat-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/embat/embat-api/revisions/36ca48bf4489/schema)