> ## Documentation Index > Fetch the complete documentation index at: https://developers.authlete.com/llms.txt > Use this file to discover all available pages before exploring further. # Create Access Token > Create an access token. ## OpenAPI ````yaml https://spec.speakeasy.com/authlete/sdk-workspace/authlete-api-explorer-with-code-samples post /api/{serviceId}/auth/token/create openapi: 3.0.3 info: title: Authlete API description: '' version: 3.0.16 license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0.html servers: - description: πŸ‡ΊπŸ‡Έ US Cluster url: https://us.authlete.com - description: πŸ‡―πŸ‡΅ Japan Cluster url: https://jp.authlete.com - description: πŸ‡ͺπŸ‡Ί Europe Cluster url: https://eu.authlete.com - description: πŸ‡§πŸ‡· Brazil Cluster url: https://br.authlete.com security: - bearer: [] tags: - name: Service Management description: >- API endpoints for managing services, including creation, update, and deletion of services. x-tag-expanded: false - name: Client Management description: >- API endpoints for managing OAuth clients, including creation, update, and deletion of clients. x-tag-expanded: false - name: Authorization Endpoint description: API endpoints for implementing OAuth 2.0 Authorization Endpoint. x-tag-expanded: false - name: Pushed Authorization Endpoint description: >- API endpoints for implementing OAuth 2.0 Pushed Authorization Requests (PAR). x-tag-expanded: false - name: Token Endpoint description: API endpoints for implementing OAuth 2.0 Token Endpoint. x-tag-expanded: false - name: Token Operations description: >- API endpoints for various token related operations, including creating, revoking and deleting access_tokens with specified scopes. x-tag-expanded: false - name: Introspection Endpoint description: API endpoints for implementing OAuth 2.0 Introspection Endpoint. x-tag-expanded: false - name: Revocation Endpoint description: API endpoint for implementing OAuth 2.0 Revocation Endpoint. x-tag-expanded: false - name: UserInfo Endpoint description: API endpoints for implementing OpenID Connect UserInfo Endpoint. x-tag-expanded: false - name: JWK Set Endpoint description: API endpoints for to generate JSON Web Key Set (JWKS) for a service. x-tag-expanded: false - name: Discovery Endpoint description: API endpoints for implementing OpenID Connect Discovery. x-tag-expanded: false - name: Configuration Endpoint description: API endpoint for accessing configuration settings for a service. x-tag-expanded: false - name: Dynamic Client Registration description: API endpoints for implementing OAuth 2.0 Dynamic Client Registration. x-tag-expanded: false - name: CIBA description: >- API endpoints for implementing Client-Initiated Backchannel Authentication (CIBA). x-tag-expanded: false - name: Grant Management Endpoint description: >- API endpoint for implementing OAuth 2.0 grants, including grant management actions like updating and revoking grants. x-tag-expanded: false - name: Jose Object description: API endpoints for JOSE objects. x-tag-expanded: false - name: Device Flow description: API endpoints for implementing OAuth 2.0 Device Flow x-tag-expanded: false - name: Federation Endpoint description: API endpoints for implementing OpenID Federation using Authlete. x-tag-expanded: false - name: Verifiable Credential Issuer description: >- API endpoints for implementing and running a Verifiable Credential Issuer (VCI). x-tag-expanded: false - name: Hardware Security Key description: API endpoints for managing hardware security keys (HSK). x-tag-expanded: false - name: Utility Endpoints description: API endpoints for various utility operations. x-tag-expanded: false - name: Native SSO description: API endpoints for Native SSO x-tag-expanded: false paths: /api/{serviceId}/auth/token/create: post: tags: - Token Operations summary: Create Access Token description: | Create an access token. operationId: auth_token_create_api parameters: - in: path name: serviceId description: A service ID. schema: type: string required: true requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/token_create_request' example: grantType: AUTHORIZATION_CODE clientId: 26888344961664 subject: john scopes: - history.read - timeline.read application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/token_create_request' responses: '200': description: Token created successfully content: application/json: schema: $ref: '#/components/schemas/token_create_response' example: resultCode: A109001 resultMessage: >- [A109001] An access token was created successfully: authorization_code, client = 26888344961664 accessToken: Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q action: OK clientId: 26888344961664 expiresAt: 1642048148973 expiresIn: 3600 grantType: AUTHORIZATION_CODE refreshToken: 9beh15GWkGLseBBO1tPobnsGpKLHV3mTkm0EWnNBa4g scopes: - history.read - timeline.read subject: john tokenType: Bearer '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '500': $ref: '#/components/responses/500' x-codeSamples: - lang: typescript label: Typescript (SDK) source: |- import { Authlete } from "@authlete/typescript-sdk"; const authlete = new Authlete({ bearer: process.env["AUTHLETE_BEARER"] ?? "", }); async function run() { const result = await authlete.token.management.create({ serviceId: "", tokenCreateRequest: { grantType: "AUTHORIZATION_CODE", clientId: 26888344961664, subject: "john", scopes: [ "history.read", "timeline.read", ], }, }); console.log(result); } run(); - lang: ruby label: Ruby (SDK) source: >- require 'authlete_ruby_sdk' Models = ::Authlete::Models s = ::Authlete::Client.new( bearer: '' ) res = s.token_management.create(service_id: '', token_create_request: Models::Components::TokenCreateRequest.new( grant_type: Models::Components::GrantType::AUTHORIZATION_CODE, client_id: 26_888_344_961_664, subject: 'john', scopes: [ 'history.read', 'timeline.read', ] )) unless res.token_create_response.nil? # handle response end - lang: go label: Go (SDK) source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tauthlete \"github.com/authlete/authlete-go-sdk\"\n\t\"github.com/authlete/authlete-go-sdk/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := authlete.New(\n authlete.WithSecurity(os.Getenv(\"AUTHLETE_BEARER\")),\n )\n\n res, err := s.Token.Management.Create(ctx, \"\", components.TokenCreateRequest{\n GrantType: components.GrantTypeAuthorizationCode,\n ClientID: authlete.Pointer[int64](26888344961664),\n Subject: authlete.Pointer(\"john\"),\n Scopes: []string{\n \"history.read\",\n \"timeline.read\",\n },\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.TokenCreateResponse != nil {\n // handle response\n }\n}" x-code-samples: - lang: shell label: curl source: > curl -v -X POST https://us.authlete.com/api/21653835348762/auth/token/create \ -H 'Content-Type:application/json' \ -H 'Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F' \ -d '{ "grantType": "AUTHORIZATION_CODE", "clientId": 26888344961664, "subject": "john", "scopes": [ "history.read", "timeline.read" ] }' - lang: java label: java source: | AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); TokenCreateRequest req = new TokenCreateRequest(); req.setGrantType(GrantType.AUTHORIZATION_CODE) req.setClientId(26888344961664) req.setSubject("john") req.setScopes({ "history.read", "timeline.read" }); api.tokenCreate(req); - lang: python source: | conf = ... api = AuthleteApiImpl(conf) req = TokenCreateRequest() req.grantType = GrantType.AUTHORIZATION_CODE req.clientId = 26888344961664 req.subject = 'john' req.scopes = [ 'history.read', 'timeline.read' ] api.tokenCreate(req) components: schemas: token_create_request: type: object required: - grantType properties: grantType: $ref: '#/components/schemas/grant_type' clientId: type: integer format: int64 description: > The ID of the client application which will be associated with a newly created access token. subject: type: string description: > The subject (= unique identifier) of the user who will be associated with a newly created access token. This parameter is required unless the grant type is `CLIENT_CREDENTIALS`. The value must consist of only ASCII characters and its length must not exceed 100. scopes: type: array items: type: string description: > The scopes which will be associated with a newly created access token. Scopes that are not supported by the service cannot be specified and requesting them will cause an error. accessTokenDuration: type: integer format: int64 description: > The duration of a newly created access token in seconds. If the value is 0, the duration is determined according to the settings of the service. refreshTokenDuration: type: integer format: int64 description: > The duration of a newly created refresh token in seconds. If the value is 0, the duration is determined according to the settings of the service. A refresh token is not created (1) if the service does not support `REFRESH_TOKEN`, or (2) if the specified grant type is either `IMPLICIT`or `CLIENT_CREDENTIALS`. properties: type: array items: $ref: '#/components/schemas/property' description: > Extra properties to associate with a newly created access token. Note that properties parameter is accepted only when the HTTP method of the request is POST and Content-Type of the request is `application/json`, so don't use `GET` method or `application/x-www-form-urlencoded` if you want to specify properties. clientIdAliasUsed: type: boolean description: > A boolean request parameter which indicates whether to emulate that the client ID alias is used instead of the original numeric client ID when a new access token is created. x-mint: metadata: description: >- A boolean request parameter which indicates whether to emulate that the client ID alias is used instead of the original numeric client ID when a new access token is created. content: > This has an effect only on the value of the aud claim in a response from [UserInfo endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). When you access the UserInfo endpoint (which is expected to be implemented using Authlete's `/api/auth/userinfo` API and `/api/auth/userinfo/issue` API) with an access token which has been created using Authlete's `/api/auth/token/create` API with this property (`clientIdAliasUsed`) `true`, the client ID alias is used as the value of the aud claim in a response from the UserInfo endpoint. Note that if a client ID alias is not assigned to the client when Authlete's `/api/auth/token/create` API is called, this property (`clientIdAliasUsed`) has no effect (it is always regarded as `false`). accessToken: type: string description: | The value of the new access token. x-mint: metadata: description: The value of the new access token. content: > The `/api/auth/token/create` API generates an access token. Therefore, callers of the API do not have to specify values of newly created access tokens. However, in some cases, for example, if you want to migrate existing access tokens from an old system to Authlete, you may want to specify values of access tokens. In such a case, you can specify the value of a newly created access token by passing a non-null value as the value of accessToken request parameter. The implementation of the `/api/auth/token/create` uses the value of the accessToken request parameter instead of generating a new value when the request parameter holds a non-null value. Note that if the hash value of the specified access token already exists in Authlete's database, the access token cannot be inserted and the `/api/auth/token/create` API will report an error. refreshToken: type: string description: | The value of the new refresh token. x-mint: metadata: description: The value of the new refresh token. content: > The `/api/auth/token/create` API may generate a refresh token. Therefore, callers of the API do not have to specify values of newly created refresh tokens. However, in some cases, for example, if you want to migrate existing refresh tokens from an old system to Authlete, you may want to specify values of refresh tokens. In such a case, you can specify the value of a newly created refresh token by passing a non-null value as the value of refreshToken request parameter. The implementation of the `/api/auth/token/create` uses the value of the refreshToken request parameter instead of generating a new value when the request parameter holds a non-null value. Note that if the hash value of the specified refresh token already exists in Authlete's database, the refresh token cannot be inserted and the `/api/auth/token/create` API will report an error. accessTokenPersistent: type: boolean description: > Get whether the access token expires or not. By default, all access tokens expire after a period of time determined by their service. If this request parameter is `true`, then the access token will not automatically expire and must be revoked or deleted manually at the service. If this request parameter is true, the `accessTokenDuration` request parameter is ignored. certificateThumbprint: type: string description: > The thumbprint of the MTLS certificate bound to this token. If this property is set, a certificate with the corresponding value MUST be presented with the access token when it is used by a client. The value of this property must be a SHA256 certificate thumbprint, base64url encoded. dpopKeyThumbprint: type: string description: > The thumbprint of the public key used for DPoP presentation of this token. If this property is set, a DPoP proof signed with the corresponding private key MUST be presented with the access token when it is used by a client. Additionally, the token's `token_type` will be set to 'DPoP'. authorizationDetails: $ref: '#/components/schemas/authz_details' resources: type: array items: type: string format: uri description: > The value of the resources to associate with the token. This property represents the value of one or more `resource` request parameters which is defined in "RFC8707 Resource Indicators for OAuth 2.0". forExternalAttachment: type: boolean description: | the flag which indicates whether the access token is for an external attachment. jwtAtClaims: type: string description: > Additional claims that are added to the payload part of the JWT access token. acr: type: string description: > The Authentication Context Class Reference of the user authentication that the authorization server performed during the course of issuing the access token. authTime: type: integer format: int64 description: > The time when the user authentication was performed during the course of issuing the access token. clientEntityIdUsed: type: boolean description: > Flag which indicates whether the entity ID of the client was used when the request for the access token was made. clientIdentifier: type: string description: | The client Identifier associated with the newly issued access token. sessionId: type: string description: > The session ID, which is the ID of the user's authentication session, associated with a newly created access token. metadataDocumentUsed: type: boolean description: > Flag indicating whether a metadata document was used to resolve client metadata for this request. When `true`, the client metadata was retrieved via the [OAuth Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/) (CIMD) mechanism rather than from the Authlete database. token_create_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. action: type: string enum: - INTERNAL_SERVER_ERROR - BAD_REQUEST - FORBIDDEN - OK description: >- The next action that the authorization server implementation should take. accessToken: type: string description: The newly issued access token. clientId: type: integer format: int64 description: | The ID of the client application associated with the access token. expiresAt: type: integer format: int64 description: | The time at which the access token expires. expiresIn: type: integer format: int64 description: | The duration of the newly issued access token in seconds. grantType: type: string description: | The grant type for the newly issued access token. properties: type: array items: $ref: '#/components/schemas/property' description: | The extra properties associated with the access token. refreshToken: type: string description: | The newly issued refresh token. scopes: type: array items: type: string description: | Scopes which are associated with the access token. subject: type: string description: > The subject (= unique identifier) of the user associated with the newly issued access token. tokenType: type: string description: | The token type of the access token. jwtAccessToken: type: string description: > If the authorization server is configured to issue JWT-based access tokens (= if `Service.accessTokenSignAlg` is set to a `non-null` value), a JWT-based access token is issued along with the original random-string one. authorizationDetails: $ref: '#/components/schemas/authz_details' forExternalAttachment: type: boolean description: | the flag which indicates whether the access token is for an external attachment. tokenId: type: string description: | Set the unique token identifier. refreshTokenScopes: type: array items: type: string description: | The scopes associated with the refresh token. May be null. clientIdentifier: type: string description: > The client Identifier that will be associated with a newly created access token. sessionId: type: string description: > The session ID associated with a newly created access token. NOTE: A refresh token must be associated with a session ID, which is the ID of the user's authentication session, in order to be used to obtain a [Native SSO](https://openid.net/specs/openid-connect-native-sso-1_0.html)-compliant ID token in the refresh token flow. grant_type: type: string description: | The grant type of the access token when the access token was created. enum: - AUTHORIZATION_CODE - IMPLICIT - PASSWORD - CLIENT_CREDENTIALS - REFRESH_TOKEN - CIBA - DEVICE_CODE - TOKEN_EXCHANGE - JWT_BEARER - PRE_AUTHORIZED_CODE property: type: object properties: key: type: string description: The key part. value: type: string description: The value part. hidden: type: boolean description: > The flag to indicate whether this property hidden from or visible to client applications. If `true`, this property is hidden from client applications. Otherwise, this property is visible to client applications. authz_details: type: object description: > The authorization details. This represents the value of the `authorization_details` request parameter in the preceding device authorization request which is defined in "OAuth 2.0 Rich Authorization Requests". properties: elements: type: array items: $ref: '#/components/schemas/authorization_details_element' description: | Elements of this authorization details. result: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. authorization_details_element: type: object required: - type properties: type: type: string description: > The type of this element. From _"OAuth 2.0 Rich Authorization Requests"_: _"The type of authorization data as a string. This field MAY define which other elements are allowed in the request. This element is REQUIRED."_ This property is always NOT `null`. locations: type: array items: type: string description: > The resources and/or resource servers. This property may be `null`. From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the location of the resource or resource server. This is typically composed of URIs."_ This property may be `null`. actions: type: array items: type: string description: > The actions. From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the kinds of actions to be taken at the resource. The values of the strings are determined by the API being protected."_ This property may be `null`. dataTypes: type: array items: type: string description: > From _"OAuth 2.0 Rich Authorization Requests"_: _"An array of strings representing the kinds of data being requested from the resource."_ This property may be `null`. identifier: type: string description: > The identifier of a specific resource. From _"OAuth 2.0 Rich Authorization Requests"_: _"A string identifier indicating a specific resource available at the API."_ This property may be `null`. privileges: type: array items: type: string description: > The types or levels of privilege. From "OAuth 2.0 Rich Authorization Requests": _"An array of strings representing the types or levels of privilege being requested at the resource."_ This property may be `null`. otherFields: type: string description: > The RAR request in the JSON format excluding the pre-defined attributes such as `type` and `locations`. The content and semantics are specific to the deployment and the use case implemented. responses: '400': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001201 resultMessage: '[A001201] /auth/authorization, TLS must be used.' '401': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001202 resultMessage: '[A001202] /auth/authorization, Authorization header is missing.' '403': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001215 resultMessage: >- [A001215] /auth/authorization, The client (ID = 26837717140341) is locked. '500': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001101 resultMessage: '[A001101] /auth/authorization, Authlete Server error.' securitySchemes: bearer: type: http scheme: bearer bearerFormat: JWT description: > Authenticate every request with a **Service Access Token** or **Organization Token**. Set the token value in the `Authorization: Bearer ` header. **Service Access Token**: Scoped to a single service. Use when automating service-level configuration or runtime flows. **Organization Token**: Scoped to the organization; inherits permissions across services. Use for org-wide automation or when managing multiple services programmatically. Both token types are issued by the Authlete console or provisioning APIs. ````