Skip to main content
POST
OAuth / Issue Token

Headers

Accept-Language
string

BCP 47 language tag for content negotiation (e.g. en, de-DE).

Example:

"en"

Body

application/json

Issues an OAuth 2.0 bearer token. The context decides which principal is authenticated (apikey, client, contract, employee, user) and the resulting token scope. Required permission: none (public endpoint)

username
string
required

Public identifier of the principal being authenticated. Meaning depends on context (e.g. API key identifier, contract login, employee login).

Required string length: 4 - 128
password
string
required

Secret credential. Must be kept confidential and never exposed in client-side code or logs.

Required string length: 4 - 128
tenant
string
required

The unique tenant identifier that determines the target environment for authentication. Scopes the issued token to the resources of the specified tenant.

Required string length: 3 - 128
context
enum<string>
required

Type of principal being authenticated; determines token scope. Allowed values: apikey (machine-to-machine API key), client (internal tenant), contract (a customer contract), employee (an employee of an employer contract), user (back-end user).

Available options:
apikey,
contract,
user,
client,
employee
Example:

"apikey"

uuid
string

Optional tenant UUID forwarded to the IdP and embedded into the issued token as data.uuid. Lets downstream gateways resolve tenant-specific configuration from a trusted, signed claim.

Required string length: 36

Response

OAuth 2.0 token issued for the authenticated principal.

access_token
string
required

Bearer token to send as Authorization: Bearer <access_token>.

refresh_token
string
required

Long-lived token to obtain a new access token without resubmitting credentials.

token_type
string
required

The token type. This endpoint only issues Bearer tokens, so the value is always Bearer.

expires_in
integer<int64>
required

Token lifetime in seconds. RFC 6749 standard.