---
title: "Create or retrieve API token for a user."
method: POST
path: "/user/token/"
tags: ["user"]
---

# Create or retrieve API token for a user.

`POST /user/token/`

Handles both:
- Users authenticating with basic credentials to get a token
- Two-factor authentication flow

## Request body

- UserAuthTokenRequest
  - `email` string, email — Email address to authenticate with
  - `password` string — Password to authenticate with
  - `totp_token` string — Two-factor authentication code

## Response `201`

Retrieved/created user API token/key.

- UserAuthToken
  - `token` string — API token for the authenticated user
  - `two_factor_required` boolean — Flag indicating whether a 2FA code is required to complete authentication
  - `two_factor_token` string — Token to use when providing 2FA code

## Other responses

- `400` — Request could not be processed (see detail).
- `403` — Locked out.
- `422` — Failed to authenticate.

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1.md) · [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api-v1/revisions/4d7879df9b2f/schema)