---
title: "Generate access token"
url: "https://docs.signnow.com/docs/oauth2/operations/post-oauth2-token"
type: "endpoint"
section: "oauth2"
slug: "oauth2/operations/post-oauth2-token"
method: "POST"
path: "/oauth2/token"
operation_id: "post-oauth2-token"
authorization: "basic"
---

# Generate access token

`POST /oauth2/token`

This endpoint allows API users to generate an access token for a user.

In the request, specify the `grant_type` to use:

- `password`: generate an access token using the [password grant](/docs/authentication#password-grant).

- `refresh_token`: generate an access token using the [refresh token grant](/docs/authentication#refresh-token-grant).

- `authorization_code`: generate an access token using the [authorization code grant](/docs/authentication#authorization-code-grant).

See also: [Authentication](/docs/authentication#about-authentication).

## Authorization

basic

## Form Data Parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `username` | string | Yes | User email. Required if `grant_type`: `password`. |
| `password` | string | Yes | User password. Required if `grant_type`: `password`. |
| `grant_type` | string | Yes | Specifies the grant type for authorization. Possible values: `password`, `refresh_token`, `authorization_code`. |
| `scope` | string | No | Permissions for the issued token; `*` grants all permissions. Using scope, you can define a custom list of accessible URLs.  For example: `document/* GET/user` will allow access to:  1) all routes starting with `/document/` 2) `GET /user` route |
| `refresh_token` | string | No | The refresh token value, obtained from the `Generate access token` response. Required if `grant_type`: `refresh_token`. |
| `code` | string | No | The authorization code, obtained from the [Get authorization code](/docs/oauth2/operations/get-oauth2-userauth) response. Required if `grant_type`: `authorization_code`. |
| `expiration_time` | integer | No | Time until the token expires in seconds. Default value is 2592000  seconds (30 days). |

## Responses

### 200

Returns an `access_token` for the user, along with its type, scope, expiration time, and `refresh_token`.

**Example** (`Successful response`)

```json
{
  "scope": "*",
  "expires_in": 2592000,
  "last_login": 1,
  "token_type": "bearer",
  "access_token": "7cXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "refresh_token": "59XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}
```

### 400

* `invalid_client`: the Basic authorization token is wrong or missing.
* `invalid_request`: a required parameter is missing, or `grant_type` is missing or not supported.
* The password or email is wrong.
* The refresh token is wrong or expired.
* The `scope` is wrong.
* The authorization code is wrong.
* The user's email isn't verified.
* The user is permanently or temporarily banned.
* The user must sign in through their organization's SSO page.

Most errors return `error` and `code`. Some return only `error`, and a wrong authorization code returns the `errors` array.

**Example** (`Wrong scope`)

```json
{
  "code": 8,
  "error": "invalid_scope"
}
```

**Example** (`Wrong password`)

```json
{
  "code": 826,
  "error": "Invalid credentials."
}
```

**Example** (`Unverified email`)

```json
{
  "code": 1545,
  "error": "unverified_email"
}
```

**Example** (`Wrong grant type`)

```json
{
  "code": 1537,
  "error": "invalid_request"
}
```

**Example** (`Wrong Basic token`)

```json
{
  "error": "invalid_client"
}
```

**Example** (`Missing Basic token`)

```json
{
  "code": 1538,
  "error": "invalid_client"
}
```

**Example** (`Wrong refresh token`)

```json
{
  "code": 997,
  "error": "Invalid refresh token. Please log out and log back in again."
}
```

**Example** (`Wrong authorization code`)

```json
{
  "errors": [
    {
      "code": 65536,
      "message": "internal api error"
    }
  ]
}
```

**Example** (`Missing required parameter`)

```json
{
  "code": 0,
  "error": "invalid_request"
}
```

**Example** (`User is permanently banned`)

```json
{
  "code": 65681,
  "error": "This account has been deactivated permanently. Please contact SignNow Customer Service to reactivate your account."
}
```

**Example** (`User is temporarily banned`)

```json
{
  "code": 65681,
  "error": "This account has been deactivated temporarily for %N% minutes. To reactivate the account sooner, please contact SignNow Customer Service."
}
```

**Example** (`User is restricted by SSO or organization`)

```json
{
  "error": "Please use your corporate login page to login to SignNow."
}
```

### 403

The user isn't the owner of the application, or the email doesn't belong to a SignNow user.

**Example** (`Access denied`)

```json
{
  "errors": [
    {
      "code": 11005001,
      "message": "Access denied."
    }
  ]
}
```

## Code Examples

> Replace `$SIGNNOW_ACCESS_TOKEN` and any `{placeholder}` values before running.

### cURL

```bash
curl -X POST \
  "https://api.signnow.com/oauth2/token" \
  -H "Authorization: Basic $SIGNNOW_ACCESS_TOKEN" \
  -H "Content-Type: application/json"
```

---
*Full reference: https://docs.signnow.com/docs/oauth2/operations/post-oauth2-token*