> ## Documentation Index
> Fetch the complete documentation index at: https://docs-dev-docs-event-stream-action-templates.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Token

> Authenticate a user with their credentials using the Resource Owner Password grant for trusted applications that cannot use redirects.

export const ResponseSchema = ({statusCode, type = "{}", children}) => {
  const [open, setOpen] = useState(false);
  return <div className="border border-gray-100 dark:border-gray-800 rounded-lg mb-3 overflow-hidden">
      <div className={`flex items-center gap-2.5 px-4 py-2.5 cursor-pointer select-none ${open ? "bg-gray-50 dark:bg-gray-800" : ""}`} onClick={() => setOpen(!open)}>
        {statusCode && <span className="border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 font-mono text-xs px-1.5 py-0.5 rounded">
            {statusCode.startsWith("default") ? "default" : statusCode}
          </span>}
        <span className="text-gray-500 dark:text-gray-400 text-sm font-mono">
          {type}
        </span>
        <span className="text-gray-400 dark:text-gray-500 text-sm italic">
          application/json
        </span>
        <svg className={`ml-auto opacity-50 transition-transform duration-200 ${open ? "rotate-180" : ""}`} width="16" height="16" viewBox="0 0 16 16" fill="none">
          <path d="M4 6l4 4 4-4" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" />
        </svg>
      </div>
      {open && <div className="px-4 pt-1 pb-3 border-t border-gray-100 dark:border-gray-800">
          {children}
        </div>}
    </div>;
};

## Endpoint

`POST /oauth/token`

<Note>
  This flow should only be used from highly-trusted applications that **cannot do redirects**. If you can use redirect-based flows from your app, we recommend using the [Authorization Code Flow](#regular-web-app-login-flow) instead.
</Note>

This is the OAuth 2.0 grant that highly-trusted apps use to access an API. In this flow, the end-user is asked to fill in credentials (username/password), typically using an interactive form in the user-agent (browser). This information is sent to the backend and from there to Auth0. It is therefore imperative that the application is absolutely trusted with this information.

### Request Headers

| Parameter             | Description                                                                                                  |
| :-------------------- | :----------------------------------------------------------------------------------------------------------- |
| `auth0-forwarded-for` | End-user IP as a string value. Set this if you want brute-force protection to work in server-side scenarios. |

### Responses

#### 200

A successful request returns the access token.

```json theme={null}
HTTP/1.1 200 OK
Content-Type: application/json
{
  "access_token":"eyJz93a...k4laUWw",
  "token_type":"Bearer",
  "expires_in":86400
}
```

### Remarks

* The scopes issued to the application may differ from the scopes requested. In this case, a `scope` parameter will be included in the response JSON.
* If you don't request specific scopes, all scopes defined for the audience will be returned due to the implied trust to the application in this grant.
* To add realm support, set the `grant_type` to `http://auth0.com/oauth/grant-type/password-realm`, and the `realm` to the realm the user belongs. This maps to a connection in Auth0.
* In addition to username and password, Auth0 may require the end-user to provide an additional factor as proof of identity. The request may return an `mfa_required` error along with an `mfa_token` for multi-factor authentication.

### Learn More

* [Calling APIs from Highly-Trusted Applications](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow)
* [Executing the Resource Owner Password Grant](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow/call-your-api-using-resource-owner-password-flow)
* [Multi-factor Authentication and Resource Owner Password](https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa)

## Headers

<ParamField header="DPoP" type="string">
  A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.
</ParamField>

## Body Parameters

<ParamField body="grant_type" type="string" required>
  Denotes the flow you are using. For Resource Owner Password use `password`.
</ParamField>

<ParamField body="username" type="string" required>
  Resource Owner's identifier, such as a username or email address.
</ParamField>

<ParamField body="password" type="string" required>
  Resource Owner's secret.
</ParamField>

<ParamField body="audience" type="string">
  The unique identifier of the target API you want to access.
</ParamField>

<ParamField body="resource" type="string">
  The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to `audience` when the tenant's [Resource Parameter Compatibility Profile](https://auth0.com/docs/get-started/tenant-settings#settings-advanced) is set to `compatibility`.
</ParamField>

<ParamField body="scope" type="string">
  String value of the different scopes the application is asking for.
</ParamField>

<ParamField body="client_id" type="string" required>
  Your application's Client ID.
</ParamField>

<ParamField body="client_secret" type="string">
  Your application's Client Secret.
</ParamField>

<ParamField body="realm" type="string">
  String value of the realm the user belongs.
</ParamField>

## Response Schema

<ResponseSchema>
  <ResponseField name="access_token" type="string">
    The access token.
  </ResponseField>

  <ResponseField name="token_type" type="string">
    The type of token. Usually `Bearer`.
  </ResponseField>

  <ResponseField name="expires_in" type="integer">
    The access token lifetime in seconds.
  </ResponseField>
</ResponseSchema>

## Response Messages

| Status | Description               |
| ------ | ------------------------- |
| 200    | Returns the access token. |