---
title: "Generate access token"
method: POST
path: "/oauth2/token"
---

# Generate access token

`POST /oauth2/token`

## Request

- Base URL: `https://api.signnow.com`
- URL: `https://api.signnow.com/oauth2/token`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/signnow/apis/signnow-api/docs/oauth2/token/post.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint allows API users to generate an access token for a user.

In the request, specify the `grant_type` to use:

- `password`: generate an access token using the [password grant](/docs/authentication#password-grant).

- `refresh_token`: generate an access token using the [refresh token grant](/docs/authentication#refresh-token-grant).

- `authorization_code`: generate an access token using the [authorization code grant](/docs/authentication#authorization-code-grant).

See also: [Authentication](/docs/authentication#about-authentication).

## Request body `multipart/form-data`

- object
  - `username` string, required: User email. Required if `grant_type`: `password`.
  - `password` string, required: User password. Required if `grant_type`: `password`.
  - `grant_type` string, required: Specifies the grant type for authorization. Possible values: `password`, `refresh_token`, `authorization_code`.
  - `scope` string: Permissions for the issued token; `*` grants all permissions. Using scope, you can define a custom list of accessible URLs. For example: `document/* GET/user` will allow access to: 1) all routes starting with `/document/` 2) `GET /user` route
  - `refresh_token` string: The refresh token value, obtained from the `Generate access token` response. Required if `grant_type`: `refresh_token`.
  - `code` string: The authorization code, obtained from the [Get authorization code](/docs/oauth2/operations/get-oauth2-userauth) response. Required if `grant_type`: `authorization_code`.
  - `expiration_time` integer: Time until the token expires in seconds. Default value is 2592000 seconds (30 days).

## Response `200`

Returns an `access_token` for the user, along with its type, scope, expiration time, and `refresh_token`.

- object
  - `scope` string: Scope of the access token, for example `*`.
  - `expires_in` integer: Number of seconds before the access token expires.
  - `last_login` integer: `1` if this is a repeat login, `0` for the first login of the user.
  - `token_type` string: Type of the token. Always `bearer`.
  - `access_token` string: Access token.
  - `refresh_token` string: Refresh token. Use it to get a new access token with the `refresh_token` grant.

## Other responses

- `400`: * `invalid_client`: the Basic authorization token is wrong or missing. * `invalid_request`: a required parameter is missing, or `grant_type` is missing or not supported. * The password or email is wrong. * The refresh token is wrong or expired. * The `scope` is wrong. * The authorization code is wrong. * The user's email isn't verified. * The user is permanently or temporarily banned. * The user must sign in through their organization's SSO page. Most errors return `error` and `code`. Some return only `error`, and a wrong authorization code returns the `errors` array.
- `403`: The user isn't the owner of the application, or the email doesn't belong to a SignNow user.

---

[API](https://skmtc.dev/signnow/apis/signnow-api.md) - [All operations](https://skmtc.dev/signnow/apis/signnow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/signnow/apis/signnow-api/revisions/1c9c30a6142b?raw)