---
title: "Generate JWT token"
method: POST
path: "/application/token/"
tags: ["Authentication"]
---

# Generate JWT token

`POST /application/token/`

Exchange application credentials for a scoped JWT token that allows the application
to act on behalf of a specific user.

The application must be authorized for the user's email domain.
The returned token expires after a configured duration and must be refreshed by calling this endpoint again.

Request parameters may be sent either as "application/x-www-form-urlencoded"
(as specified by RFC 6749 for OAuth 2.0 token endpoints) or as "application/json".

## Request body

- TokenRequest
  - `client_id` string, required — Application client identifier
  - `client_secret` string, password, required — Application secret key
  - `grant_type` 'client_credentials', required — OAuth2 grant type (must be 'client_credentials')
  - `scope` string, email, required — Email address of the user to delegate. The application will act on behalf of this user. Note: This parameter is named 'scope' to align with OAuth2 conventions, but accepts an email address to identify the user. This design allows for future extensibility.

## Response `200`

Token generated successfully

- TokenResponse
  - `access_token` string — JWT access token
  - `token_type` string — Token type (always 'Bearer')
  - `expires_in` integer — Token lifetime in seconds
  - `scope` string — Space-separated list of granted permission scopes

## Other responses

- `400` — Invalid request
- `401` — Authentication failed
- `403` — Access denied - cannot delegate user
- `415` — Unsupported media type. The request body must be sent as "application/x-www-form-urlencoded" or "application/json".

## Changes

- **2026-08-19** `33f115c58838` — 2 info
  - added the media type `application/x-www-form-urlencoded` to the request body
  - added the non-success response with the status `415`
- **2025-12-22** `17505e207332` — 1 breaking, 1 info
  - api path removed without deprecation
  - endpoint added
- **2025-10-22** `9c04eb87c2f2` — 1 info
  - endpoint added
- **2025-10-03** `1f775f325b8d` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/betagouv/apis/meet-external-api/changes/application/token/post.md)

---

[API](https://skmtc.dev/betagouv/apis/meet-external-api.md) · [All operations](https://skmtc.dev/betagouv/apis/meet-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/betagouv/meet-external-api/revisions/33f115c58838/schema)