---
title: "Create a consumer access token"
method: POST
path: "/api/v5/token"
tags: ["Authentication"]
---

# Create a consumer access token

`POST /api/v5/token`

Issues a new access token for the identity supplied in the request. Pass an `email` to identify a consumer when the client identity key is `email`. Pass a `jwt` to assert a trusted identity via JWT verification. Omit both to issue an anonymous token. The optional `duration_seconds` field caps the token lifetime.

## Request body

- CreateTokenRequest
  - `duration_seconds` integer, nullable, required — Requested token lifetime in seconds. Defaults to the client configuration value when omitted.
  - `email` string, nullable, required — Email address used to identify or create the consumer. Ignored when `jwt` is present.
  - `jwt` string, nullable, required — Signed JWT carrying consumer identity claims. When supplied, identity is derived from the token claims rather than from `email`.

## Response `200`

Created consumer access token.

- TokenResponse
  - `access_token` string, required — Opaque access token for the consumer session. Pass as a Bearer token or `access_token` query parameter on subsequent requests.
  - `expires_in` integer, required — Seconds until the token expires.
  - `scopes` string[], required — Set of permission scopes granted to this token.

## Other responses

- `400` — The token-creation request is invalid: `email` is not applicable for the client's identity key (`email_not_applicable`), or the requested token duration is outside the permitted range (`invalid_access_token_duration`).
- `401` — Unauthorized
- `403` — Forbidden
- `415` — Unsupported Media Type
- `429` — Too Many Requests

---

[API](https://skmtc.net/extole/apis/integration-api-server-to-extole.md) · [All operations](https://skmtc.net/extole/apis/integration-api-server-to-extole/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/extole/integration-api-server-to-extole/revisions/c16e62e66755/schema)