> ## Documentation Index
> Fetch the complete documentation index at: https://psw.belli.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue Access Token

> Issue OAuth2 access token using client credentials or password grant

Issue OAuth2/JWT access token using client credentials or password grant flow.

### Reference Documentation

<Info>
  For more information on authentication flows, please refer to:

  * Page 570 of "Functional\_Requirements\_V18 FINAL": [https://belli.sg/4nxxCDR](https://belli.sg/4nxxCDR)
</Info>

<ParamField status="200" type="object">
  <ParamField name="accessToken" type="string">
    JWT access token
  </ParamField>

  <ParamField name="tokenType" type="string">
    Token type (usually 'Bearer')
  </ParamField>

  <ParamField name="expiresIn" type="integer">
    Token expiration time in seconds
  </ParamField>

  <ParamField name="scope" type="string">
    Granted scopes
  </ParamField>
</ParamField>

<ParamField status="400" type="object">
  <ParamField name="error" type="string">
    Error code (e.g., 'invalid\_client', 'invalid\_grant')
  </ParamField>

  <ParamField name="errorDescription" type="string">
    Human-readable error description
  </ParamField>
</ParamField>


## OpenAPI

````yaml POST /api/auth/token
openapi: 3.0.3
info:
  title: Mock API
  version: 1.0.0
  description: >-
    Mock OpenAPI spec for QR API Service. All endpoints require API key
    authentication via 'Authorization: Bearer <token>' or 'x-api-key: <token>'
    headers.
servers:
  - url: https://1a557de0-701c-477d-bedd-433520441dae.mock.pstmn.io
    description: Production server
security:
  - ApiKeyAuth: []
  - ApiKeyHeader: []
tags:
  - name: auth-v1
    description: Authentication and user management
  - name: reference-data-v1
    description: Reference data and master data
  - name: flights-v1
    description: Flight schedules and capacity
  - name: quotes-v1
    description: Quotation and pricing
  - name: awb-stock-v1
    description: AWB Stock Management
  - name: bookings-v1
    description: Booking management
  - name: shipments-v1
    description: Shipment documents and tracking
  - name: compliance-v1
    description: Compliance and safety declarations
  - name: operations-v1
    description: Operational events and manifests
  - name: webhooks-v1
    description: Webhook management
  - name: admin-v1
    description: Administrative and audit functions
  - name: qr-exp-cgo-ext-availability-v1
    description: Legacy availability service
  - name: qr-exp-cgo-ext-booking-v1
    description: Legacy booking service
  - name: qr-exp-cgo-ext-flight-schedules-v1
    description: Legacy flight schedules service
  - name: qr-exp-cgo-shipments-v1
    description: Legacy shipments service
  - name: qr-exp-cgo-stock-v1
    description: Legacy stock service
  - name: qr-exp-cgo-tables-v1
    description: Legacy table data service
paths:
  /api/auth/token:
    post:
      tags:
        - auth-v1
      summary: Issue OAuth2/JWT access token
      description: Issue OAuth2 access token using client credentials or password grant
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
      responses:
        '200':
          description: Token issued successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthErrorResponse'
components:
  schemas:
    TokenRequest:
      type: object
      properties:
        grantType:
          type: string
          enum:
            - client_credentials
            - password
          example: client_credentials
        clientId:
          type: string
          example: your-client-id
        clientSecret:
          type: string
          example: your-client-secret
        username:
          type: string
          example: user@example.com
        password:
          type: string
          example: password
    TokenResponse:
      type: object
      properties:
        accessToken:
          type: string
          example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
        tokenType:
          type: string
          example: Bearer
        expiresIn:
          type: integer
          example: 3600
    OAuthErrorResponse:
      type: object
      properties:
        error:
          type: string
          example: invalid_grant
        errorDescription:
          type: string
          example: Invalid client credentials provided
        errorUri:
          type: string
          example: https://docs.example.com/oauth/errors
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
    ApiKeyHeader:
      type: apiKey
      in: header
      name: x-api-key

````