---
title: "Create a token."
method: POST
path: "/api/v1/sanctum/token"
tags: ["Endpoints"]
---

# Create a token.

`POST /api/v1/sanctum/token`

## Request

- Base URL: `https://hidemail.app`
- URL: `https://hidemail.app/api/v1/sanctum/token`
- Auth: none required

This endpoint lets you create a permanent token. When the account has
two-factor authentication enabled and the client sends
`two_factor_supported: true`, it returns `409` with a challenge to
exchange at `POST /api/v1/sanctum/token/two-factor`.

## Request body

- object
  - `email` string, required: Email.
  - `password` string, required: Password.
  - `device_name` string, required: Device Name.
  - `two_factor_supported` boolean: Declares that the client can complete a two-factor challenge. Defaults to false.

## Response `200`

- union
  - object: Two-factor authentication off
    - `token` string
  - object: Legacy client during the grace window
    - `token` string
    - `warnings` object[]
      - `code` string
      - `message` string
      - `enforced_at` string

## Other responses

- `403`: Legacy client after the cutover
- `409`: Two-factor challenge required
- `422`: Wrong credentials

---

[API](https://skmtc.dev/hidemail/apis/hidemail-app-api.md) · [All operations](https://skmtc.dev/hidemail/apis/hidemail-app-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hidemail/apis/hidemail-app-api/revisions/168255500dfd?raw)