---
title: "Token"
method: POST
path: "/com/v4/token"
tags: ["Myinfo"]
---

# Token

`POST /com/v4/token`

This API generates an access token when presented with a valid authcode obtained from the Authorise API. This token can then be used to request for the user's data that were consented.

## Headers

- `DPoP` string, required

## Response `200`

OK.

Returning a JSON object which contains the authorization access token (JWT) that will be used to retrieve the data from Myinfo.

- AuthTokenResponse — Authorisation Token Response JSON
  - `access_token` object, required — Access token to be used in the subsequent resource endpoint call. This is in the form of JWT (JSON web token). Include this in your header as 'Bearer' when invoking the resource API. This JWT complies to the standard 'JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants' (https://tools.ietf.org/html/rfc7523). **Note:** This token is returned in the form of a compact serialized string. Decode and verify the signature before use.
    - `sub` string — (subject) This is the identifier of the user who logged in.
    - `scope` string — Space separated list of scopes allowed. This is the list scopes user has consented to.
    - `nbf` string — (not before) - the time before which the token MUST NOT be accepted for processing
    - `iss` string — (issuer) Issuer of the JWT.
    - `txnid` string — (transaction id) Unique string for reconciliation of transaction.
    - `client` object — OAuth 2 client information and UEN info
      - `client_id` string — Client ID
      - `client_name` string — Client Name
      - `entity_uen` string — UEN of Entity
      - `entity_name` string — Name of Entity
    - `subentity` object — Entity that is receving the data
      - `subclient_id` string — Client ID of the receiving Entity
      - `subclient_name` string — Client Name of the receiving Entity
      - `entity_name` string — Entity Name of the receiving Entity
      - `entity_uen` string — UEN of the receiving Entity
      - `whitelist` boolean — Indicator if receiving entity is whitelisted
    - `expires_in` string — The remaining lifetime of the access token.
    - `iat` string — (issued at) Time which JWT was issued at.
    - `exp` string — (expiration time) time which JWT will expire
    - `realm` string — Realm for OAuth process.
    - `aud` string — Audience for JWT.
    - `jti` string — (JWT ID) unique identifier for the JWT token.
    - `cnf` object
      - `jkt` string — Thumbprint of jwk in DPoP Proof
    - `jku` string — JWKS url to retrieve partner's public encryption key
    - `epk` object — Partner's public key in JWK format
      - `use` string — (Public Key Use) Identifies the intended use of the public key, such as "enc"
      - `alg` string — (Algorithm) Identifies the algorithm intended for use with the key
      - `kty` string — (Key Type) Identifies the cryptographic algorithm family used with the key, such as "EC"
      - `kid` string — (Key ID) Used to match a specific key, the ID of the key
      - `crv` string — Curve of the EC key
      - `x` string — Generated from the EC public key
      - `y` string — Generated from the EC public key
  - `token_type` string, required — Type of token (Bearer)
  - `expires_in` integer — Expiry of access token (in seconds)
  - `scope` string — Scopes requested, separated by space

## Other responses

- `400` — Possible scenarios: - Same authcode in the body is being re-used. We do not allow same authcode being used in multiple calls. Ensure that authcode is not repeated. - AuthCode error - missing, invalid, expired, revoked
- `401` — Unauthorized. Possible scenarios: - No client assertion provided - Invalid client ID used. Digital service is not registered. - Incorrect client assertion. - Ensure that correct key is used to sign the assertion metadata
- `403` — Forbidden Possible scenarios: - Incorrect API URL used. Refer to tutorial for the correct API URL(test/production)
- `500` — Unexpected error. Check response body for actual error.

---

[API](https://skmtc.net/singpass/apis/myinfo-api.md) · [All operations](https://skmtc.net/singpass/apis/myinfo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/singpass/myinfo-api/revisions/320a99d164e4/schema)