---
title: "Exchange Formify API key for short-lived access token"
method: POST
path: "/auth/token"
tags: ["auth"]
---

# Exchange Formify API key for short-lived access token

`POST /auth/token`

## Request

- Base URL: `https://docs-api.formify.eu/v1`
- URL: `https://docs-api.formify.eu/v1/auth/token`
- Auth: HTTP apikey

Exchange a Formify API key, for example `sk_live_YOUR_API_KEY`, for a short-lived Bearer `access_token`. Test keys use the same format with the `sk_test_` prefix.

OAuth 2.0 with PKCE remains the recommended authentication method for integrations that support it. This endpoint exists for MCP clients and third-party platforms that cannot complete OAuth/PKCE and only allow a user to paste a token.

Send the API key in the `Authorization` header using the `ApiKey` scheme:

```http
Authorization: ApiKey sk_live_YOUR_API_KEY
```

The response contains an `access_token` that is used exactly like an OAuth access token:

```http
Authorization: Bearer {access_token}
```

Do not call protected API endpoints directly with the API key.

## Query parameters

- `scope` 'read' | 'write' | 'read write'

## Response `200`

Access token generated successfully

- ApiKeyTokenResponse: Token response returned after exchanging a Formify API key at `/auth/token`. This response is intentionally aligned with OAuth token responses so clients can use the returned `access_token` in the same way: send it as `Authorization: Bearer {access_token}` to protected API endpoints. API key exchange does not return a `refresh_token`. When the access token expires, exchange the API key again.
  - `access_token` string, required: The short-lived JWT access token used for authenticating API requests.
  - `expires_in` integer, required: The lifetime of the access token in seconds.
  - `token_type` string, required: The type of token issued. Always `Bearer`.
  - `scope` string, required: Space-separated list of permissions granted to this token (`read`, `write`, or `read write`).

## Other responses

- `400`: Missing or invalid request
- `401`: Unauthorized - invalid or disabled API key
- `500`: Internal server error

---

[API](https://skmtc.dev/formify/apis/formify-api.md) · [All operations](https://skmtc.dev/formify/apis/formify-api/llms.txt) · [OpenAPI document](https://skmtc.dev/formify/apis/formify-api/revisions/571c4c0d4f4f?raw)