---
title: "Generate Token"
method: POST
path: "/api/auth/token"
tags: ["Authentication Service"]
---

# Generate Token

`POST /api/auth/token`

Authenticate using **Basic Authentication** with username/password or client credentials.

This endpoint is typically used by a web or mobile application at login when the user first enters their credentials.

Returns an **access_token** and, optionally, a **refresh_token** depending on the type of authentication.

**Note: The refresh_token is only issued for web or mobile authentication users; it is not returned for machine-to-machine (M2M) authentication**.

**Header example**:
```
Authorization: Basic base64(username:password)
```

## Response `200`

Token generated successfully

- OAuth2TokenResponse — Response returned after successful authentication/refresh.
  - `access_token` string, required — JWT access token used to access secure Clerk Tools APIs.
  - `token_type` string, required — Token type; typically 'Bearer'.
  - `expires_in` integer, required — Number of seconds until the access token expires.
  - `refresh_token` string, required — Refresh token used to obtain a new access token. Previous refresh_token expires when a new one is issued. Must be stored securely and never exposed outside the application. Not generated for machine-to-machine (M2M) authentication; only available for web or mobile login.

## Other responses

- `401` — Invalid username or password
- `500` — Internal server error

---

[API](https://skmtc.dev/flclerktools/apis/clerk-tools-user-authorization.md) · [All operations](https://skmtc.dev/flclerktools/apis/clerk-tools-user-authorization/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/flclerktools/clerk-tools-user-authorization/revisions/cfeae2fa2eb4/schema)