---
title: "Obtain OAuth2 Token (Legacy — password grant)"
method: POST
path: "/ws/oauth2/grant"
tags: ["Authentication"]
---

# Obtain OAuth2 Token (Legacy — password grant)

`POST /ws/oauth2/grant`

## Request

- Base URL: `https://stage.ema-api.com/ema-dev/firm/apiportal/ema`
- URL: `https://stage.ema-api.com/ema-dev/firm/apiportal/ema/ws/oauth2/grant`
- Auth: API key in header `x-api-key`

**Legacy authentication — being sunset.** Obtain an access token using the OAuth2 `password` grant. Send your sandbox `x-api-key` plus `username`/`password`. The token is an HS256 JWT and a `refresh_token` is returned. New integrations should use the OAuth2 `client_credentials` flow described in the **Authentication** guide. Treat the returned `access_token` as an opaque Bearer token.

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` string, required
  - `username` string, required: The username provided to you
  - `password` string, required: The password provided to you

## Response `200`

Access token response

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string

## Other responses

- `400`: BAD REQUEST - The request was bad, often due to a missing required parameter
- `401`: NOT AUTHORIZED - Authentication error; this token is not allowed access to the API
- `403`: FORBIDDEN
- `404`: NOT FOUND
- `422`: UNPROCESSABLE ENTITY - Request could not be processed; typically a validation error
- `429`: TOO MANY REQUESTS - Request was rate limited (1000 calls/min default); please retry
- `500`: SERVER ERROR - Internal Server Error

---

[API](https://skmtc.dev/modmed/apis/ema-proprietary-api.md) - [All operations](https://skmtc.dev/modmed/apis/ema-proprietary-api/llms.txt) - [OpenAPI document](https://skmtc.dev/modmed/apis/ema-proprietary-api/revisions/c03c1956a05d?raw)