---
title: "Request an Access Token"
method: POST
path: "/v1/login/oauth/access_token"
tags: ["Authentication API"]
---

# Request an Access Token

`POST /v1/login/oauth/access_token`

Use this endpoint to get an access token for a user or client.

You can only use **one authentication method per request** — pick the one that fits your use case:

- **For users**: Authenticate with `username`, `password`, and `grantType = password`.  
- **For machine-to-machine (M2M)**: Use `clientId`, `clientSecret`, and set `grantType = client_credentials`.

## Request body

- union — Information used to request an access token. Use one authentication method per request.
  - PasswordGrantInput — Username and password authentication for user login.
    - `grantType` 'password', required — Grant type for username and password authentication.
    - `username` string, required — Username for authentication.
    - `password` string, password, required — Password for authentication.
  - ClientCredentialsGrantInput — Client credentials authentication for machine-to-machine (M2M) access.
    - `grantType` 'client_credentials', required — Grant type for client credentials authentication.
    - `clientId` string, required — The unique identifier of the client provided by Identity.
    - `clientSecret` string, password, required — The secret key associated with the ClientID used for secure authentication.

## Response `200`

Returns the access credentials on successful authentication.

If the user has MFA enabled, the response will contain an `MFAChallengeResponse` instead, with a temporary `mfaToken` to complete the verification flow through the MFA endpoints.

- union
  - OAuth2Token — Information used to manage OAuth2 authentication data. It securely stores access credentials, ensuring seamless authorization and control over protected resources.
    - `accessToken` string, required — A temporary token that grants the user secure access the APIs.
    - `expiresIn` integer, required — The time (in seconds) until the token expires.
    - `idToken` string — The identity details about the authenticated user in OpenID Connect standards. It can be used to verify user authentication.
    - `refreshToken` string, required — A long-lived token that allows users to obtain a new `access_token` without requiring them to log in again.
    - `scope` string — The level of access granted to the issued tokens
    - `tokenType` string, required — The type of token issued.
  - MFAChallengeResponse — Returned when MFA verification is required after successful credential validation. Contains the temporary MFA token and available verification methods.
    - `mfaRequired` boolean, required — Indicates that MFA verification is required to complete authentication.
    - `mfaToken` string, required — Temporary token used to complete the MFA flow. Pass this to the MFA verify or challenge endpoints.
    - `availableMethods` string[], required — List of MFA methods configured for the user.
    - `preferredMethod` 'app' | 'email' | 'sms', required — The user's preferred MFA method.

## Other responses

- `400`
- `401`
- `500`

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/versions/25daba385532/schema)