---
title: "Generate tokens to access other KLARA core endpoints"
method: POST
path: "/core/latest/token"
tags: ["Authentication"]
---

# Generate tokens to access other KLARA core endpoints

`POST /core/latest/token`

## Request

- Base URL: `https://api.klara.ch`
- URL: `https://api.klara.ch/core/latest/token`
- Auth: none declared

After obtaining tenant id and company id for the desired tenant, use this endpoint to get the access token for a specific tenant, and refresh token. <br />A grant_type of <strong>password</strong> is used for a Password grant, which requires username, password, tenant and company id to produce access token, refresh token from scratch.<br />A grant_type of <strong>refresh_token</strong> is used for a Refresh token grant, which is used for acquiring the access token using refresh token.<br />A grant_type of <strong>token_exchange</strong> performs an OAuth 2.0 Token Exchange (RFC 8693). Provide <strong>subject_token</strong> (the raw upstream Bearer token, without the 'Bearer ' prefix) and <strong>audience</strong> to identify the target token type.<br />Supported audience values:<ul><li><strong>cossa</strong> &mdash; exchanges a COSSA bearer token for a ePost access token.</li></ul><strong>Note:</strong> subject_token must be the raw token value without the 'Bearer ' prefix.

## Response `200`

Token created

- PublicAPIToken: A public api token object. This object holds info of tokens that can be used to access KLARA Public API
  - `access_token` string: Token used to access KLARA Public API endpoints, should be place at Authorization header of request. Access token is valid only for one company tenant
  - `expires_in` integer: Amount of time in seconds left that the access token is valid for
  - `refresh_expires_in` integer: Amount of time in seconds left that the refresh token is valid for
  - `refreshToken` string: Token used to renew the access token
  - `token_type` string: Type of access token that should be included in the Authorziation header of each request

## Other responses

- `400`: Could not get token<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `401`: Invalid credentials<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `429`: API rate limit exceeded<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `500`: Internal server error<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.

---

[API](https://skmtc.dev/klara/apis/klara-public-api.md) · [All operations](https://skmtc.dev/klara/apis/klara-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/klara/apis/klara-public-api/revisions/490b1a879fc2?raw)