---
title: "Optional endpoint to generate a single-use, time-limited, `m.login.token` token."
method: POST
path: "/_matrix/client/v1/login/get_token"
tags: ["Session management"]
---

# Optional endpoint to generate a single-use, time-limited, \`m.login.token\` token.

`POST /_matrix/client/v1/login/get_token`

## Request

- Base URL: `https://matrix.org`
- URL: `https://matrix.org/_matrix/client/v1/login/get_token`
- Auth: one of:
  - API key in query parameter `access_token`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/matrix/apis/matrix-client-server-api/docs/_matrix/client/v1/login/get_token/post.ts> (a function with typed inputs; its response is checked against the schema)

Optional endpoint - the server is not required to implement this endpoint if it does not
intend to use or support this functionality.

This API endpoint uses the [User-Interactive Authentication API](https://spec.matrix.org/v1.19/client-server-api/#user-interactive-authentication-api).

An already-authenticated client can call this endpoint to generate a single-use, time-limited,
token for an unauthenticated client to log in with, becoming logged in as the same user which
called this endpoint. The unauthenticated client uses the generated token in a `m.login.token`
login flow with the homeserver.

Clients, both authenticated and unauthenticated, might wish to hide user interface which exposes
this feature if the server is not offering it. Authenticated clients can check for support on
a per-user basis with the [`m.get_login_token`](https://spec.matrix.org/v1.19/client-server-api/#mget_login_token-capability) capability,
while unauthenticated clients can detect server support by looking for an `m.login.token` login
flow with `get_login_token: true` on [`GET /login`](https://spec.matrix.org/v1.19/client-server-api/#post_matrixclientv3login).

In v1.7 of the specification, transmission of the generated token to an unauthenticated client is
left as an implementation detail. Future MSCs such as [MSC3906](https://github.com/matrix-org/matrix-spec-proposals/pull/3906)
might standardise a way to transmit the token between clients.

The generated token MUST only be valid for a single login, enforced by the server. Clients which
intend to log in multiple devices must generate a token for each.

With other User-Interactive Authentication (UIA)-supporting endpoints, servers sometimes do not re-prompt
for verification if the session recently passed UIA. For this endpoint, servers MUST always re-prompt
the user for verification to ensure explicit consent is gained for each additional client.

Servers are encouraged to apply stricter than normal rate limiting to this endpoint, such as maximum
of 1 request per minute.

## Request body

- object
  - `auth` object: Used by clients to submit authentication information to the interactive-authentication API
    - `session` string: The value of the session key given by the homeserver.
    - `type` string: The authentication type that the client is attempting to complete. May be omitted if `session` is given, and the client is reissuing a request which it believes has been completed out-of-band (for example, via the [fallback mechanism](https://spec.matrix.org/v1.19/client-server-api/#fallback)).

## Response `200`

The login token an unauthenticated client can use to log in as the requesting user.

- object
  - `expires_in_ms` integer, required: The time remaining in milliseconds until the homeserver will no longer accept the token. `120000` (2 minutes) is recommended as a default.
  - `login_token` string, required: The login token for the `m.login.token` login flow.

## Other responses

- `400`: The request was malformed, or the user does not have an ability to generate tokens for their devices, as implied by the [User-Interactive Authentication API](https://spec.matrix.org/v1.19/client-server-api/#user-interactive-authentication-api). Clients should verify whether the user has an ability to call this endpoint with the [`m.get_login_token`](https://spec.matrix.org/v1.19/client-server-api/#mget_login_token-capability) capability.
- `401`: The homeserver requires additional authentication information.
- `429`: This request was rate-limited.

---

[API](https://skmtc.dev/matrix/apis/matrix-client-server-api.md) - [All operations](https://skmtc.dev/matrix/apis/matrix-client-server-api/llms.txt) - [OpenAPI document](https://skmtc.dev/matrix/apis/matrix-client-server-api/revisions/c7fe4072c681?raw)