---
title: "Login"
method: POST
path: "/v1/auth/token"
tags: ["auth"]
---

# Login

`POST /v1/auth/token`

## Request

- Base URL: `https://app.tokumalabs.com/api`
- URL: `https://app.tokumalabs.com/api/v1/auth/token`
- Auth: none declared. Required headers: `x-device-id`

OAuth2 password flow for authentication using username and password.

## Headers

- `x-device-id` string, required
- `x-device-name` string, nullable
- `x-platform` string, nullable
- `x-app-version` string, nullable

## Request body `application/x-www-form-urlencoded`

- BodyAuthLogin
  - `grant_type` string, nullable
  - `username` string, required
  - `password` string, password, required
  - `scope` string
  - `client_id` string, nullable
  - `client_secret` string, password, nullable

## Response `200`

Successful Response

- TokenResponse
  - `access_token` string, required: JWT access token
  - `token_type` string: Token type
  - `expires_in_seconds` integer, required: Token expiration time in seconds
  - `scope` string: OAuth2 scopes

## Other responses

- `400`: Validation error or domain rule violation.
- `401`: Missing, expired, or invalid authentication.
- `403`: Authenticated but not permitted.
- `404`: Resource not found.
- `409`: Resource state conflict (duplicate, illegal transition).
- `422`: Request body failed schema validation.
- `500`: Server-side failure.

---

[API](https://skmtc.dev/tokumalabs/apis/tokuma-user-api.md) - [All operations](https://skmtc.dev/tokumalabs/apis/tokuma-user-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tokumalabs/apis/tokuma-user-api/revisions/1f8201af459b?raw)