Auth.CreateToken

Try it in Swagger

Exchanges a contact email and password for a Bearer token. Send the API key in the X-Api-Key header — not as clientCode. After this call, send both X-Api-Key and Authorization: Bearer {token} on authorized endpoints. See Authentication.

Endpoint

Method: POST
Route: Auth/Token
Authentication: Anonymous

This endpoint does not require Authorization: Bearer {token}. The returned token is used on subsequent authorized requests.

Request Schema

Headers

Header	Required	Notes
`X-Api-Key`	Required when tenant is not resolved by subdomain	The long hex API key. Resolves the tenant. Do not put this value in `clientCode`.

JSON Body

Body type: SessionTokenRequest

Field	Type	Required	Notes
`clientCode`	`string?`	No	Short tenant code (for example `TRISTAR`). Optional when `X-Api-Key` is present. If sent, it must match the tenant the key belongs to.
`userId`	`string`	Yes	Contact email in the tenant database.
`password`	`string`	Yes	Contact password in the tenant database.

Request Sample

POST /Auth/Token
Content-Type: application/json
X-Api-Key: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

{
  "userId": "contact@example.com",
  "password": "your-password"
}

Expected Response Schema

Status Codes

Status	Notes
`200 OK`	Returned by the controller for this operation.
`404 Not Found`	Requested resource or draft was not found.

Success Body

Response type: TokenResponse

Field	Type	Required	Notes
`token`	`string`	Yes	JWT used as `Authorization: Bearer {token}` on later requests.
`tokenType`	`string`	Yes	`Bearer`.
`expiresInMinutes`	`int`	No
`customerCode`	`string`	Yes
`contactCode`	`string`	Yes
`contact`	`string`	Yes

Response Sample

{
  "token": "jwt-token-value",
  "tokenType": "Bearer",
  "expiresInMinutes": 60,
  "customerCode": "ABC001",
  "contactCode": 456,
  "contact": "Maria Contact"
}