---
title: "Obtain OAuth2 Token (Legacy — password grant)"
method: POST
path: "/ws/oauth2/grant"
tags: ["Authentication"]
---

# Obtain OAuth2 Token (Legacy — password grant)

`POST /ws/oauth2/grant`

**Legacy authentication — being sunset.** Obtain an access token using the OAuth2 `password` grant. Send your sandbox `x-api-key` plus `username`/`password`. The token is an HS256 JWT and a `refresh_token` is returned. New integrations should use the OAuth2 `client_credentials` flow described in the **Authentication** guide. Treat the returned `access_token` as an opaque Bearer token.

## Response `200`

Access token response

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string

## Other responses

- `400` — BAD REQUEST - The request was bad, often due to a missing required parameter
- `401` — NOT AUTHORIZED - Authentication error; this token is not allowed access to the API
- `403` — FORBIDDEN
- `404` — NOT FOUND
- `422` — UNPROCESSABLE ENTITY - Request could not be processed; typically a validation error
- `429` — TOO MANY REQUESTS - Request was rate limited (1000 calls/min default); please retry
- `500` — SERVER ERROR - Internal Server Error

---

[API](https://skmtc.net/modmed/apis/ema-proprietary-api-authentication.md) · [All operations](https://skmtc.net/modmed/apis/ema-proprietary-api-authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/modmed/ema-proprietary-api-authentication/revisions/2c8b6a756f84/schema)