# Create Token ## OpenAPI Specification ```yaml openapi: 3.0.1 info: title: '' description: '' version: 1.0.0 paths: /v3/{loyalty_club_slug}/members/oauth/token: post: summary: Create Token deprecated: false description: ":::caution\nWe highly recommend utilizing our new Member Identity Provider to manage the standard OAuth flow, particularly for new integrations.\nFor comprehensive technical details, please refer to the [Member Identity Provider docs](https://member-idp.developer.placewise.com/).\n:::\n\nCreates a new access token by one of three methods (grant types):\n\n* `password` - token is issued by providing [Password](api-3510810#password),\n see: [Creating token with password grant](api-3510810#creating-token-with-password-grant)\n* `external_token` - token is issued by social provider oauth token such as google or apple,\n see: [Creating token with external token](api-3510810#creating-token-with-external_token-grant)\n* `refresh_token` - token is issued by providing refresh token obtained from `password` grant type,\n see: [Refreshing token](api-3510810#refreshing-token-with-refresh_token-grant)\n\n## Body Parameters\n\nParameter | Description | Type | For grant type\n--------- | ------- | ----- | -----\ngrant_type | type of grant | enum: `password`, `refresh_token`, `external_token` | -\nidentifier_type | identifier type that user should be retrieved by | enum: `id`, `email`, `msisdn` | `password`\nidentifier | value of member identifier | mixed (e.g. `134123123`, `+47123456789` or `alice@example.com`) | `password`\npassword | member password, One-Time-Password or Registration Password | string | `password`\nexternal_token | member external_token, External Token | string | `external_token`\nexternal_token_type | member external_token type, allowed values: [google apple] | string | `external_token`\nrefresh_token | refresh token | string | `access_token`\n\n### Password\n\nWe allow following `password` types, depending on Loyalty Club setup:\n\n* [Member Password](api-3510819#member-password)\n* [One-Time Password](api-3510813)\n* [Registration Password](api-3510817) -\n may be used to sign in the user right after registration, without sending additional OTP\n\n## Response Body\n\nKey | Description | Type\n--------- | ----------- | ---------\naccess_token | Token that member can be authenticated with | string\ntoken_type | Always \"bearer\" | string\nexpires_in | Seconds for how long token will be valid | integer (seconds)\nrefresh_token | Token that may be used to issue a new :access_token | string\ncreated_at | When the token has been created | integer (timestamp)\nresource_owner_id | ID of member that the token has been for | integer\n\nIn response, two tokens are returned:\n\n* `access_token` that is valid for **24 hours** - may be used to authenticate member in member-related actions (see: [OAuth](doc-341646)).\n* `refresh_token` which is valid for **1 year** - may be used to get a new access token (with `refresh_token` grant)\n\nAlso, `resource_owner_id` is returned, it is an ID of member that the token has been issued for.\n\n## Error Responses\n\nStatus | Reason\n--------- | -----------\n`461` | Invalid member credentials provided for `password` grant. Either member could not be found or password is wrong\n`462` | Invalid refresh_token provided for `refresh_token` grant (may be expired)\n`463` | Invalid external_token provided for `external_token` grant\n\n## Example\n\n### Creating token with `password` grant\n\nWhen creating new access token, `\"grant_type\": \"password\"` should be given along with member credentials.\n\n```shell title=\"Create token grant type password example:\"\ncurl -X POST \"https://api.mpc.placewise.com/v3/infinity-mall/members/oauth/token\" \\\n -H 'content-type: application/json' \\\n -H 'x-client-authorization: B7t9U9tsoWsGhrv2ouUoSqpM' \\\n -H 'x-product-name: default' \\\n -H 'x-user-agent: CURL manual test' \\\n -d '{\n \"grant_type\": \"password\",\n \"identifier_type\": \"id\",\n \"identifier\": 42,\n \"password\": \"123\"\n }'\n```\n\n### Creating token with `external_token` grant\n\nWhen creating new access token, `\"grant_type\": \"external_token\"` should be given along with member credentials.\n\n```shell title=\"Create token grant type external_token example:\"\ncurl -X POST \"https://api.mpc.placewise.com/v3/infinity-mall/members/oauth/token\" \\\n -H 'content-type: application/json' \\\n -H 'x-client-authorization: B7t9U9tsoWsGhrv2ouUoSqpM' \\\n -H 'x-product-name: default' \\\n -H 'x-user-agent: CURL manual test' \\\n -d '{\n \"grant_type\": \"external_token\",\n \"external_token\": \"123\",\n \"external_token_type\": \"google\"\n }'\n```\n\n### Refreshing token with `refresh_token` grant\n\nYou can obtain a new token after (or before) it's expiration time, by using `refresh_token` grant.\n\nParam `grant_type: \"refresh_token\"` must be provided along with `refresh_token: \":refresh_token\"`.\n\nIt returns a token response, same as for `password` or `external_id` grant, but with new tokens.\n\n```shell title=\"Refresh token example:\"\ncurl -X POST \"https://api.mpc.placewise.com/v3/infinity-mall/members/oauth/token\" \\\n -H 'content-type: application/json' \\\n -H 'x-client-authorization: B7t9U9tsoWsGhrv2ouUoSqpM' \\\n -H 'x-product-name: default' \\\n -H 'x-user-agent: CURL manual test' \\\n -d '{\n \t \"grant_type\": \"refresh_token\",\n \t \"refresh_token\": \"36c636e4290d28488a13691afce351397bec21b1246c2c7896a8262d9bfbc4c4\"\n }'\n```\n\nWhen successful, above commands return JSON structured like this:\n\n```json\n{\n \"access_token\": \"af9e5361cd7e083dfa4132df3ea7ab82fac21496991632a9994a8c2a9f33884f\",\n \"token_type\": \"bearer\",\n \"expires_in\": 86400,\n \"refresh_token\": \"36c636e4290d28488a13691afce351397bec21b1246c2c7896a8262d9bfbc4c4\",\n \"created_at\": 1506523094,\n \"resource_owner_id\": 42\n}\n```" tags: - API Reference/Public API/Member/Authentication parameters: - name: loyalty_club_slug in: path description: '' required: true example: infinity-mall schema: type: string - name: Content-Type in: header description: '[Details](doc-341635)' required: true example: application/json schema: type: string default: application/json const: application/json - name: X-User-Agent in: header description: Arbitrary identifier of your client. [Details](doc-341635) required: true example: '{{X_USER_AGENT}}' schema: type: string default: '{{X_USER_AGENT}}' - name: X-Product-Name in: header description: API Product for API context. [Details](doc-341635) required: true example: '{{PRODUCT_NAME}}' schema: type: string default: '{{PRODUCT_NAME}}' - name: X-Loyalty-Club-Slug in: header description: LoyaltyClub for API context. [Details](doc-342138) required: false example: '{{LOYALTY_CLUB_SLUG}}' schema: type: string default: '{{LOYALTY_CLUB_SLUG}}' - name: X-Customer in: header description: Customer for API context. [Details](doc-342139) required: false example: '{{CUSTOMER_ID}}' schema: type: string default: '{{CUSTOMER_ID}}' - name: Authorization in: header description: '[Member](doc-342129) or [User](doc-342130) Authorization.' required: false example: Bearer {{_OAUTH_TOKEN}} schema: type: string default: Bearer {{_OAUTH_TOKEN}} - name: X-Client-Authorization in: header description: '[Token](doc-342128) Authorization.' example: '{{API_TOKEN}}' schema: type: string default: '{{API_TOKEN}}' requestBody: content: application/json: schema: type: object properties: {} example: grant_type: password identifier_type: id identifier: '{{MEMBER_ID}}' password: '{{MEMBER_PASSWORD}}' responses: '200': description: '' content: application/json: schema: type: object properties: {} headers: {} x-apidog-name: Success security: [] x-apidog-folder: API Reference/Public API/Member/Authentication x-apidog-status: pending x-run-in-apidog: https://app.eu.apidog.com/web/project/346351/apis/api-3510810-run components: schemas: {} securitySchemes: {} servers: - url: https://api.mpc.dev.placewise.com description: Staging security: [] ```