# POST /authenticationserver/token

> Request an access token like POST /oauth/token, with the same form fields and Basic header, but never forward a failed request to other authentication servers.

- **Product:** DS Server
- **Section:** Documentation
- **Kind:** Endpoint
- **Path:** DS Server > API Reference > Web API > Authentication Server > /token > POST /authenticationserver/token
- **840 words**
- **Web URL:** https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/token/post/
- **LLMs URL:** https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/token/post/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/token/post/llms-full.txt

---

`POST` `https://example.com/authenticationserver/token`

### Description

Requests an access token like [POST /oauth/token](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/token/post/llms-full.txt), with the same parameters, authorization and responses, but without forwarding an unsuccessful request to the registered authentication servers. The endpoint was added in DS Server 3.1.0.

When `POST /oauth/token` can't authorize a request, DS Server sends the same form data and *Basic* authorization header to `/authenticationserver/token` of the registered authentication servers and returns the answer.

### Examples

This sample requests an access token with the "client\_credentials" grant type.

```bash
# Request:
curl --request POST 'https://trial.dsserver.io/authenticationserver/token' \
    --user 'yourclientid:yourclientsecret' \
    --data-urlencode 'grant_type=client_credentials'

# Response:
{
    "access_token": "nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T",
    "token_type": "Bearer",
    "expires_in": "3600"
}
```

### Authorization

The "client\_credentials" grant type requires the Basic authorization method. For the "authorization\_code" grant type, the client ID and client secret are sent as the form fields `client_id` and `client_secret` instead.

#### Basic

| Header field | Description |
|---|---|
| Authorization | The client ID and the client secret of the security profile are combined into a string separated by a colon, e.g.: clientid:clientsecret. The resulting string is encoded using the RFC2045-MIME variant of Base64, except not limited to 76 char/line. The authorization method and a space i.e. "Basic " is then put before the encoded string. For example: `Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l` |

### Request Payload

| Type | Value |
|---|---|
| TokenData | The form fields of [POST /oauth/token](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/token/post/#request-payload) in the "application/x-www-form-urlencoded" format. |

### Success Response

| Status | Description |
|---|---|
| 200 | On success, the HTTP status code in the response header is 200 (OK). It returns a JSON object with `access_token`, `token_type` and `expires_in`, as POST /oauth/token does. The "authorization\_code" and "refresh\_token" grant types also return a new `refresh_token`. |

### Error Response

The 400 errors return a JSON object with the fields `error` and `error_description`, as POST /oauth/token does. The table lists some of them; all of them are listed on [POST /oauth/token](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/token/post/#error-response).

| Status | Description |
|---|---|
| 400 | `invalid_request` "Missing authorization header." is returned, if the "client\_credentials" grant type is requested without a Basic authorization header. |
| 400 | `invalid_client` "Invalid client ID." or "Invalid client secret." is returned, if the client credentials don't match a security profile of this instance. |
| 400 | `unsupported_grant_type` "This security profile does not allow the specified grant type. (client\_credentials)" is returned, if the grant type is not supported or not allowed for the security profile. The grant type that was sent is given in parentheses. |

---

## Nearby

- **Previous:** [/authenticationserver/token](https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/token/llms-full.txt)
- **Next:** [/authenticationserver/authorize](https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/authorize/llms-full.txt)