---
title: "Create access token"
method: POST
path: "/auth/token"
tags: ["Client Authorization"]
---

# Create access token

`POST /auth/token`

Create a new token to access user resources.

## Request body

- union
  - UserCredentialRequest
    - `grant_type` 'password', required
    - `username` string, email, required — E-mail address/finX account username.
    - `password` string, required — The finX account password.
    - `scope` string — A space delimited set of requested permissions. The requested permissions can be narrower but not broader than the permissions agreed during application registration. If this parameter is omitted, the permissions agreed during application registration are used in place.
  - RefreshTokenRequest
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required — A refresh token that may be used to request new access tokens. Refresh tokens remain valid for a maximum of 90 days.
    - `scope` string — A space delimited set of requested permissions. The requested permissions can be narrower but not broader than the permissions agreed during application registration. If this parameter is omitted, the permissions agreed during application registration are used in place.
  - AuthorizationCodeRequest
    - `grant_type` 'authorization_code', required
    - `code` string, required — The authorization code returned after completing the OAuth flow.
    - `redirect_uri` string, url — If the callback URL was specified in the initial request, then it must also be included in this request. The value defaults to the first redirect URI configured for the client.

## Response `200`

Created

- AccessToken
  - `access_token` string, required — The access token for the current user as JSON Web Token according to RFC7519. It has a variable length and it is highly advised to not limit the size of the database field in your storage backend. If you have to specify a size for the corresponding database field a choice of at least 2048 bytes is highly recommended.
  - `expires_in` integer, required — The remaining lifetime of the access token in seconds.
  - `scope` string — A space delimited set of requested permissions. The requested permissions can be narrower but not broader than the permissions agreed during application registration. If this parameter is omitted, the permissions agreed during application registration are used in place.
  - `token_type` 'Bearer', required — The type of the issued token.
  - `refresh_token` string — A refresh token is only included in the response if the client's scope includes the `offline` permission. The same considerations as for the `access_token` regarding the token length apply here also.

## Other responses

- `401` — unresolved $ref
- `404` — The specified resource was not found.
- `4XX` — unresolved $ref

---

[API](https://skmtc.net/qwist/apis/finx-api.md) · [All operations](https://skmtc.net/qwist/apis/finx-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/qwist/finx-api/revisions/b75f5c1aa39e/schema)