> ## Documentation Index > Fetch the complete documentation index at: https://chargecloud.dev/llms.txt > Use this file to discover all available pages before exploring further. # OAuth / Issue Token > Issues an OAuth 2.0 bearer token. The context decides which principal is authenticated (apikey, client, contract, employee, user) and the resulting token scope. Required permission: none (public endpoint) ## OpenAPI ````yaml /api/core-api/crmiapi.json post /api/v1/oauth/token openapi: 3.2.0 info: title: chargecloud - Core API summary: chargecloud Core API. All around CRM, Asset Management and more. version: 1.141.0 description: chargecloud Core API. All around CRM, Asset Management and more. servers: - url: https://api.chargecloud.dev description: Production - chargecloud Core API - url: https://demo.chargecloud.de description: Sandbox/Dev - chargecloud Core API security: [] paths: /api/v1/oauth/token: post: tags: - OAuth summary: OAuth / Issue Token description: >- Issues an OAuth 2.0 bearer token. The context decides which principal is authenticated (apikey, client, contract, employee, user) and the resulting token scope. Required permission: none (public endpoint) operationId: /api/v1/oauth/token_POST parameters: - name: Accept-Language in: header description: BCP 47 language tag for content negotiation (e.g. en, de-DE). required: false schema: type: string description: BCP 47 language tag for content negotiation (e.g. en, de-DE). example: en requestBody: description: >- Issues an OAuth 2.0 bearer token. The context decides which principal is authenticated (apikey, client, contract, employee, user) and the resulting token scope. Required permission: none (public endpoint) content: application/json: schema: type: object required: - username - password - tenant - context properties: username: type: string minLength: 4 maxLength: 128 description: >- Public identifier of the principal being authenticated. Meaning depends on `context` (e.g. API key identifier, contract login, employee login). password: type: string minLength: 4 maxLength: 128 description: >- Secret credential. Must be kept confidential and never exposed in client-side code or logs. tenant: type: string minLength: 3 maxLength: 128 description: >- The unique tenant identifier that determines the target environment for authentication. Scopes the issued token to the resources of the specified tenant. context: type: string enum: - apikey - contract - user - client - employee description: >- Type of principal being authenticated; determines token scope. Allowed values: `apikey` (machine-to-machine API key), `client` (internal tenant), `contract` (a customer contract), `employee` (an employee of an employer contract), `user` (back-end user). example: apikey uuid: type: string minLength: 36 maxLength: 36 description: >- Optional tenant UUID forwarded to the IdP and embedded into the issued token as data.uuid. Lets downstream gateways resolve tenant-specific configuration from a trusted, signed claim. required: true responses: '200': headers: Content-Language: description: The locale of the response content (BCP 47 language tag). required: false schema: type: string example: en content: application/json: schema: type: object required: - access_token - refresh_token - token_type - expires_in properties: access_token: type: string description: >- Bearer token to send as `Authorization: Bearer `. refresh_token: type: string description: >- Long-lived token to obtain a new access token without resubmitting credentials. token_type: type: string description: >- The token type. This endpoint only issues Bearer tokens, so the value is always `Bearer`. expires_in: type: integer format: int64 description: Token lifetime in seconds. RFC 6749 standard. description: OAuth 2.0 token issued for the authenticated principal. '400': headers: Content-Language: description: The locale of the response content (BCP 47 language tag). required: false schema: type: string example: en content: application/json: schema: type: object required: - error properties: error: type: string description: Error message description: Bad request '405': headers: Content-Language: description: The locale of the response content (BCP 47 language tag). required: false schema: type: string example: en content: application/json: schema: type: object required: - error properties: error: type: string description: Error message description: Method not allowed '422': headers: Content-Language: description: The locale of the response content (BCP 47 language tag). required: false schema: type: string example: en content: application/json: schema: type: object required: - errors properties: errors: type: array items: type: object properties: errorKey: type: string description: A key identifying the error message: type: string description: The error message parameter: type: string description: The parameter that caused the error, if any required: - errorKey - message - parameter description: Error description: List of errors description: Request validation failed ```` ## Related topics - [OAuth / Refresh Token](https://chargecloud.dev/api-reference/oauth/oauth-refresh-token.md) - [OAuth userinfo endpoint](https://chargecloud.dev/api-reference/oauth/oauth-userinfo-endpoint.md) - [Authentication](https://chargecloud.dev/authentication.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.