---
title: "POST /openapi/{version}/auth/token/obtain/{application}/"
method: POST
path: "/openapi/{version}/auth/token/obtain/{application}/"
tags: ["Authentication"]
---

# POST /openapi/{version}/auth/token/obtain/{application}/

`POST /openapi/{version}/auth/token/obtain/{application}/`

## Request

- Base URL: `https://base_url`
- URL: `https://base_url/openapi/{version}/auth/token/obtain/{application}/`
- Auth: none declared

This endpoint allows you to obtain a **JWT Access Token** to authenticate and authorize your API requests to the Locad system. To generate the token, you must provide your **username**, **password**, and **brand_id** (which will be provided by the Locad team). The **JWT Access Token** will be used for subsequent API calls to access secure resources.

### Token Validity:
`access : 24 Hours`
`refresh : 7 Days`
### Request Example:
Use the following `curl` command to obtain a JWT Access Token:

```bash
curl --location '{{url}}/openapi/v2/auth/token/obtain/MERCHANT_APP/' \
--header 'Content-Type: application/json' \
--data-raw '{
    "username": "{{username}}",
    "password": "{{password}}",
    "data": {
        "brand_id": {{brand_id}}
    }
}''
```

Replace `username`, `password`, and `brand_id` with the appropriate values.

Upon successful authentication, you will receive an **Access Token** and a **Refresh Token**, which will be used to authorize your requests and refresh your token when it expires. The response includes the **access token** and **refresh token**.

The **JWT Access Token** is required for making authorized API calls within the Locad system. It is valid for a set period, after which it can be refreshed using the **Refresh JWT Access Token** API.

## Path parameters

- `application` string, required
- `version` string, required

## Request body

- TokenObtainPair
  - `username` string, required
  - `password` string, required
  - `access` string, required
  - `refresh` string, required

## Response `200`

JWT token successfully generated. You can now use the provided access token for authorized API requests.

- EnvelopedTokenObtainPair
  - `success` boolean
  - `data` TokenObtainPair, required
    - `username` string, required
    - `password` string, required
    - `access` string, required
    - `refresh` string, required
  - `message` string, required

## Other responses

- `400`: Bad Request - Invalid input.
- `401`: Unauthorized - Invalid or expired credentials.
- `403`: Forbidden - You do not have permission to access this resource.
- `404`: Not Found - The requested resource does not exist.
- `500`: Internal Server Error - Unexpected error occurred.

---

[API](https://skmtc.dev/golocad/apis/locad-api.md) - [All operations](https://skmtc.dev/golocad/apis/locad-api/llms.txt) - [OpenAPI document](https://skmtc.dev/golocad/apis/locad-api/revisions/428200f33a81?raw)