---
title: "Get bearer token"
method: POST
path: "/auth/token"
tags: ["Auth"]
---

# Get bearer token

`POST /auth/token`

Exchanges an OMS API key + secret for a bearer token valid for 60 minutes. The token is signed by the OMS issuer and must be presented as `Authorization Bearer <token>` on every other endpoint.

## Request body

- AuthorizeRequest
  - `apiKey` string, required — Secret API key identifier. Prefix encodes (mode, env): `sk_live_…` / `sk_sdbx_…` on prod; non-prod envs add an env infix (`sk_dev_sdbx_…`, `sk_stg_live_…`, …). The matching apiSecret is shown once at key creation and stored only as an HMAC hash.
  - `apiSecret` string, required — Opaque secret revealed once at key creation; not a typeid.

## Response `200`

Token issued

- AuthorizeResponse
  - `accessToken` string, required
  - `tokenType` 'bearer', required
  - `expiresIn` integer, required
  - `expiresAt` string, date-time, required

## Other responses

- `400` — Malformed request body
- `401` — Invalid or revoked credentials
- `429` — Too many requests from this client IP. Retry after the interval in the `Retry-After` header.
- `500` — Internal error

---

[API](https://skmtc.net/polygon-technology/apis/polygon-oms-public-api.md) · [All operations](https://skmtc.net/polygon-technology/apis/polygon-oms-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/polygon-technology/polygon-oms-public-api/revisions/18fdaebf64e5/schema)