---
title: "Generates an Access Token."
method: POST
path: "/auth/token"
tags: ["Security"]
---

# Generates an Access Token.

`POST /auth/token`

## Request

- Base URL: `https://api-sandbox.merchants.zalando.com`
- URL: `https://api-sandbox.merchants.zalando.com/auth/token`
- Auth: HTTP basic

Issues a new Access Token for the given client credentials.

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'client_credentials' | 'password', required: OAuth 2.0 grant type.
  - `scope` 'access_token_only': OAuth 2.0 scope.
  - `username` string: User's username (if grant_type=password).
  - `password` string: User's password (if grant_type=password).

## Response `200`

Returns a new Access Token.

- AccessToken: OAuth 2.0 Access Token response.
  - `token_type` string, required: Type of the Access Token that should be used in the Authorization header.
  - `access_token` string, required: Identifier for the Access Token.
  - `expires_in` integer, required: Number of seconds until the Access Token expires.
  - `scope` string: Scopes added to the Access Token.

## Other responses

- `400`: Credentials or the grant type are incorrect.
- `429` (unresolved $ref)

---

[API](https://skmtc.dev/zalando/apis/authentication.md) - [All operations](https://skmtc.dev/zalando/apis/authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/zalando/apis/authentication/revisions/6a57e109b9af?raw)