---
title: "Create an authentication token"
method: POST
path: "/o/token/"
tags: ["Bearer Tokens"]
---

# Create an authentication token

`POST /o/token/`

> ⚠️ Use Session Tokens In Production
>
> To keep your app secure, long-lived authentication tokens in production are only for server-side requests. Client-side requests in production must use [session tokens](https://docs.joinforage.app/reference/create-session-token).

> 📘 Managing OAuth Token Expiration
>
> OAuth tokens expire after **7 days** by default (604800 seconds), but can be configured to expire sooner or up to 30 days. There can be up to 1000 active authentication tokens for a Client ID and Client Secret pair at any given time. To manage the number of active authentication tokens, use the [`/o/revoke_token/`](https://docs.joinforage.app/reference/revoke-authentication-token) endpoint to revoke a single token, or [`/o/bulk_revoke/`](https://docs.joinforage.app/reference/bulk-revoke-auth-tokens) to revoke in bulk.


> 📘 Authentication Guide
>
> Check out the Forage [authentication guide](https://docs.joinforage.app/docs/authentication) for more details on authentication tokens.


A `POST` request to `/o/token/` creates a new authentication token. The token is returned as the `access_token` value in the response body.


An authentication token is a long-lived OAuth 2.0 bearer token that validates requests from your backend to Forage. Pass an authentication token in the `Authorization` header of server-side requests to handle sensitive tasks like creating an order or capturing a payment.


You need your app’s Client ID and Client Secret from the Forage dashboard ([sandbox](https://dashboard.sandbox.joinforage.app/), [production](https://dashboard.joinforage.app/)) to generate an authentication token. If you don’t yet have dashboard access, then please [get in touch](https://www.joinforage.com/get-in-touch).

## Response `200`

__OK__ - Success

- object
  - `access_token` string — The authentication token to include as the bearer token in the header of server-side requests.
  - `expires_in` integer — The number of seconds until the token expires.
  - `token_type` string — The type of the token, the constant string `"Bearer"`.
  - `scope` string — The token's permissions level.

## Other responses

- `400` — __Bad request__ - The request was not accepted because of an error in the request body or path.
- `401` — __Unauthorized__

---

[API](https://skmtc.dev/joinforage/apis/forage-payments-api.md) · [All operations](https://skmtc.dev/joinforage/apis/forage-payments-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/joinforage/forage-payments-api/revisions/4b7212706fae/schema)