Sign in

v1

latestOpenAPI 3.1.02026-07-261055249.9 KB
Client Authorization

Create access token

Create a new token to access user resources.

post/auth/token

Request body

OR
OR

Example request

{
  "grant_type": "password",
  "username": "user@example.com",
  "password": "hunter2",
  "scope": "accounts=ro balance=ro transactions=ro offline"
}

Response

Created

access_tokenstring required

The access token for the current user as JSON Web Token according to RFC7519. It has a variable length and it is highly advised to not limit the size of the database field in your storage backend. If you have to specify a size for the corresponding database field a choice of at least 2048 bytes is highly recommended.

expires_ininteger required

The remaining lifetime of the access token in seconds.

scopestring

A space delimited set of requested permissions. The requested permissions can be narrower but not broader than the permissions agreed during application registration. If this parameter is omitted, the permissions agreed during application registration are used in place.

token_type'Bearer' required

The type of the issued token.

refresh_tokenstring

A refresh token is only included in the response if the client's scope includes the offline permission. The same considerations as for the access_token regarding the token length apply here also.

Example response

{
  "access_token": "AoFmNJLDTW8jQtGSJ1iZeeoLiwNZ2ihz3iiCHGpuvE439nppuY",
  "expires_in": 3600,
  "scope": "accounts=ro balance=ro transactions=ro offline",
  "token_type": "Bearer",
  "refresh_token": "RTfI2WNyK78NozupDH9ai8GPRbjjdVsXPPt..."
}