Tolgee Octri Demo
POST/v2/user/generate-super-token

Generate a token for sensitive operations

Generates a JWT access token for the authenticated user to use with sensitive operations. Provide otp when TOTP is enabled or password when TOTP is not enabled. The response contains the generated token and its token type.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

2 body fields

Credentials used to generate a JWT for sensitive operations. Provide otp when TOTP is enabled or password when it is not.

otpstringoptional
Has to be provided when TOTP enabled
passwordstringoptional
Has to be provided when TOTP not enabled

5 status codes
200Returns an object containing the generated `accessToken` and its `tokenType`.
accessTokenstringoptional
tokenTypestringoptional
400Returned when the credential request is invalid.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
401Returned when the supplied authentication credential is rejected.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
403Returned when the authenticated user is not permitted to generate the token.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional
404Returned when the associated user or resource cannot be found.
codestringrequired
Allowed:unauthenticatedapi_access_forbiddenapi_key_not_foundinvalid_api_keyinvalid_project_api_keyproject_api_key_expiredbad_credentialsmfa_enabledinvalid_otp_codemfa_not_enabledcan_not_revoke_own_permissionsdata_corrupted
paramsarray<object>optional

Error handling

A 400 is returned when the credential request is invalid. A 401 is returned when the supplied authentication credential is rejected, a 403 when the authenticated user is not permitted to generate the token, and a 404 when the associated user or resource cannot be found. Provide otp when TOTP is enabled; otherwise provide password.