Tolgee Octri Demo
POST/api/public/generatetoken

Generate an access token with username and password

Authenticates a user with a username and password and generates a JWT access token. Supply non-empty username and password values; include otp when required for the account's authentication flow. The successful response contains the token and its type.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

3 body fields

Credentials and any additional one-time password required to authenticate the user.

otpstringoptional
A one-time password for accounts that require an additional authentication factor.
passwordstringrequired
The user's password; must contain at least one character.
usernamestringrequired
The user's username; must contain at least one character.

5 status codes
200Returns an object containing the generated `accessToken` and the token type.
accessTokenstringoptional
tokenTypestringoptional
400Returned when the request is invalid or required credentials are missing.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
401Returned when the credentials or authentication details are not accepted.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
403Returned when access to the requested operation is forbidden.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
404Returned when a requested resource was not found.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional

Error handling

A 400 indicates an invalid request, a 401 indicates that the credentials or authentication details were not accepted, and a 403 indicates forbidden access. A 404 indicates that a requested resource was not found. The body must include non-empty username and password values; provide otp when the authentication flow requires it.