--- title: "Request token" method: POST path: "/token" tags: ["OAuth"] --- # Request token `POST /token` ## Request - Base URL: `https://go.urbanairship.com` - URL: `https://go.urbanairship.com/token` - Auth: HTTP basic - TypeScript: (a function with typed inputs; its response is checked against the schema) Request an OAuth access token with Basic Auth or an assertion. When making a request with an assertion, do not provide the Basic Auth header. See also [OAuth 2.0](/developer/rest-api/ua/api-security/#oauth-20) in the *Airship API Security* documentation. Use `oauth2.asnapius.com` for Airship's North American cloud site and `oauth2.asnapieu.com` for Airship's European cloud site when requesting an OAuth token. ## Headers - `Content-Type` string, required ## Request body `application/x-www-form-urlencoded` - union - RequestTokenBasicAuth - `grant_type` 'client_credentials', required - `ipaddr` string: A list of CIDR representations of valid IP addresses to which the issued token is restricted. IP addresses can be sent as a URL-encoded, space-delimited list (example: `ipaddr=24.20.40.0%2F24%202001%3A4860%3A4860%3A%3A8888%2F32`) or as a list as expected in a query parameter form (example: `ipaddr=24.20.40.0/24&ipaddr=2001:4860:4860::8888/32`). - `scope` 'att' | 'chn' | 'cnt' | 'tpl' | 'evt' | 'jny' | 'lst' | 'nu' | 'pln' | 'psh' | 'rpt' | 'sch': The value of the scope parameter is a list of space-delimited, case-sensitive strings. If multiple scopes are specified, their order does not matter. Each string adds an additional access range to the requested scope. For more information about scope values, see [OAuth token scopes](/developer/rest-api/ua/api-auth-reference/#oauth-token-scopes) in the *Airship API Authorization Reference* documentation. * `att`: Attachments * `chn`: Channels * `cnt`: Contacts * `tpl`: Content * `evt`: Events * `jny`: Journeys * `lst`: Lists * `nu`: Named Users * `pln`: Pipelines * `psh`: Push * `rpt`: Reports * `sch`: Schedules - `sub` unknown, required - RequestTokenWithAssertion - `assertion` AssertionJwt, required: A JSON Web Token (JWT) used for authorization in [OAuth token requests](/developer/rest-api/ua/operations/oauth/#requestoauthtoken). The JWT must be signed with the private key corresponding to the `client_id` in the `kid` header using the ES384 algorithm. - `alg` 'ES384', required: The signing algorithm. - `kid` string, required: The key used to sign the JWT, the `client_id`. - `aud` string, required: The valid request endpoint. Example: `https://oauth2.asnapius.com/token` - `exp` integer, required: The `assertion`'s expiration timestamp in seconds since epoch, after which it is not valid. The expiry must not be more than 10 minutes in the future. This is for the `assertion`, not for the token that will be returned. Example: `1681862754` - `iat` integer, required: The issue timestamp in seconds since epoch. Example: `168186250` - `ipaddr` string: A space-delimited list of CIDR representations of valid IP addresses to which the issued token is restricted. - `iss` string, required: The issuer, the `client_id`. - `nonce` string, required: A unique string that must not have been used recently with this `client_id`. We will store this for a minimum of 2 hours. If you are relying on the nonce to defend against replay attacks, it is recommended to also enforce a narrow *ipaddr* range in order to prevent requests that utilize the returned access token from being replayed by an outside client. - `scope` 'att' | 'chn' | 'cnt' | 'tpl' | 'evt' | 'jny' | 'lst' | 'nu' | 'pln' | 'psh' | 'rpt' | 'sch': The value of the scope parameter is a list of space-delimited, case-sensitive strings. If multiple scopes are specified, their order does not matter. Each string adds an additional access range to the requested scope. For more information about scope values, see [OAuth token scopes](/developer/rest-api/ua/api-auth-reference/#oauth-token-scopes) in the *Airship API Authorization Reference* documentation. * `att`: Attachments * `chn`: Channels * `cnt`: Contacts * `tpl`: Content * `evt`: Events * `jny`: Journeys * `lst`: Lists * `nu`: Named Users * `pln`: Pipelines * `psh`: Push * `rpt`: Reports * `sch`: Schedules - `sub` unknown, required - `grant_type` 'client_credentials', required ## Response `200` Returned on token request success. - OkOauthTokenResponse: Issued access token. - `access_token` string: The issued token that can be used for all endpoints as allowed by set scopes. - `expires_in` integer: The number of seconds from the time the token is generated until it expires. - `scope` 'att' | 'chn' | 'cnt' | 'tpl' | 'evt' | 'jny' | 'lst' | 'nu' | 'pln' | 'psh' | 'rpt' | 'sch': The value of the scope parameter is a list of space-delimited, case-sensitive strings. If multiple scopes are specified, their order does not matter. Each string adds an additional access range to the requested scope. For more information about scope values, see [OAuth token scopes](/developer/rest-api/ua/api-auth-reference/#oauth-token-scopes) in the *Airship API Authorization Reference* documentation. * `att`: Attachments * `chn`: Channels * `cnt`: Contacts * `tpl`: Content * `evt`: Events * `jny`: Journeys * `lst`: Lists * `nu`: Named Users * `pln`: Pipelines * `psh`: Push * `rpt`: Reports * `sch`: Schedules - `token_type` 'Bearer': The type of issued token. ## Other responses - `400`: Token not generated. - `401`: Unauthorized. - `406`: Not acceptable. ## Changes - **2026-06-24** `38241778b0c1`: 1 breaking, 3 warning - removed `subschema #1: Request token with Basic Auth, subschema #2: Request token with assertion` from the request body `oneOf` list - added the new `jny` enum value to the `scope` response property for the response status `200` - added the new `rpt` enum value to the `scope` response property for the response status `200` - added the new `tpl` enum value to the `scope` response property for the response status `200` - …this revision’s changelog is incomplete [Operation history](https://skmtc.dev/airship/apis/airship-api/changes/token/post.md) --- [API](https://skmtc.dev/airship/apis/airship-api.md) - [All operations](https://skmtc.dev/airship/apis/airship-api/llms.txt) - [OpenAPI document](https://skmtc.dev/airship/apis/airship-api/revisions/bd6ab947117a?raw)