---
title: "Generate token"
method: POST
path: "/v1/auth/token"
tags: ["auth_endpoints"]
---

# Generate token

`POST /v1/auth/token`

## Request

- Base URL: `https://partners.tryotter.com`
- URL: `https://partners.tryotter.com/v1/auth/token`
- Auth: none required
- TypeScript: <https://skmtc.dev/cloudkitchens/apis/otter-api/docs/v1/auth/token/post.ts> (a function with typed inputs; its response is checked against the schema)

Client credentials in the request-body and HTTP Basic Auth are supported.

## Request body `application/x-www-form-urlencoded`

- OAuthTokenGenerationRequest: The entity to request a token, following the OAuth2.0 protocol.
  - `client_id` string, uuid: The ID of the client (also known as the Application ID).
  - `client_secret` string: The secret of the client.
  - `grant_type` 'client_credentials' | 'authorization_code', required: The OAuth2.0 grant types supported.
  - `scope` string, required: The scope to request, multiple scopes are passed delimited by a space character.
  - `code` string, nullable: The authorization code obtained from the server when performing the authorization code flow. It is required to exchange the code for an access token that will be used to perform actions on behalf of a user.
  - `redirect_uri` string, nullable: The redirect URI that was included in the initial authorization request. The value must be an exact match of the previously used URI, otherwise the request will be rejected.
  - `code_verifier` string, nullable: If the code_challenge parameter was included in the initial authorization requests, the application must now provide the code verifier. The value is the plaintext string that was used to calculate the hash that was previously sent in the code_challenge parameter.

## Response `200`

The token was successfully generated.

- HydraToken
  - `access_token` string: The auth token used when consuming the API endpoints.
  - `expires_in` integer: Token lifetime in seconds. The default is 30 days, but this returned value is authoritative for the issued token.
  - `scope` string: The scopes available for the token.
  - `token_type` string: The token type is always "bearer".

## Other responses

- `400`: The request is malformed.
- `401`: Invalid authorization.
- `422`: The request body is not valid.

---

[API](https://skmtc.dev/cloudkitchens/apis/otter-api.md) - [All operations](https://skmtc.dev/cloudkitchens/apis/otter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cloudkitchens/apis/otter-api/revisions/4c868194a467?raw)