<commit_before>[role="xpack"]
[[security-api-get-token]]
=== Get token API
++++
<titleabbrev>Get token</titleabbrev>
++++

Creates a bearer token for access without requiring basic authentication.

[[security-api-get-token-request]]
==== {api-request-title}

`POST /_security/oauth2/token` 


[[security-api-get-token-desc]]
==== {api-description-title}

The tokens are created by the {es} Token Service, which is automatically enabled
when you configure TLS on the HTTP interface. See <<tls-http>>. Alternatively,
you can explicitly enable the `xpack.security.authc.token.enabled` setting. When 
you are running in production mode, a bootstrap check prevents you from enabling 
the token service unless you also enable TLS on the HTTP interface. 

The get token API takes the same parameters as a typical OAuth 2.0 token API
except for the use of a JSON request body.

A successful get token API call returns a JSON structure that contains the access
token, the amount of time (seconds) that the token expires in, the type, and the
scope if available.

The tokens returned by the get token API have a finite period of time for which
they are valid and after that time period, they can no longer be used. That time
period is defined by the `xpack.security.authc.token.timeout` setting. For more
information, see <<token-service-settings>>.

If you want to invalidate a token immediately, you can do so by using the 
<<security-api-invalidate-token,invalidate token API>>.


[[security-api-get-token-request-body]]
==== {api-request-body-title}

The following parameters can be specified in the body of a POST request and
pertain to creating a token:

`grant_type`::
(string) The type of grant. Supported grant types are: `password`, `_kerberos`,
`client_credentials` and `refresh_token`. The `_kerberos` grant type
is supported internally and implements SPNEGO based Kerberos support. The `_kerberos`
grant type may change from version to version.

`password`::
(string) The user's password. If you specify the `password` grant type, this 
parameter is required. This parameter is not valid with any other supported
grant type.

`kerberos_ticket`::
(string) base64 encoded kerberos ticket. If you specify the `_kerberos` grant type,
this parameter is required. This parameter is not valid with any other supported
grant type.

`refresh_token`::
(string) If you specify the `refresh_token` grant type, this parameter is 
required. It contains the string that was returned when you created the token 
and enables you to extend its life. This parameter is not valid with any other
supported grant type.

`scope`::
(string) The scope of the token. Currently tokens are only issued for a scope of
`FULL` regardless of the value sent with the request.

`username`::
(string) The username that identifies the user. If you specify the `password` 
grant type, this parameter is required. This parameter is not valid with any
other supported grant type.

[[security-api-get-token-example]]
==== {api-examples-title}

The following example obtains a token using the `client_credentials` grant type,
which simply creates a token as the authenticated user:

[source,js]
--------------------------------------------------
POST /_security/oauth2/token
{
  "grant_type" : "client_credentials"
}
--------------------------------------------------
// CONSOLE

The following example output contains the access token, the amount of time (in
seconds) that the token expires in, and the type:

[source,js]
--------------------------------------------------
{
  "access_token" : "<KEY>
  "type" : "Bearer",
  "expires_in" : 1200
}
--------------------------------------------------
// TESTRESPONSE[s/<KEY>/$body.access_token/]

The token returned by this API can be used by sending a request with a
`Authorization` header with a value having the prefix `Bearer ` followed
by the value of the `access_token`.

[source,shell]
--------------------------------------------------
curl -H "Authorization: Bearer dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==" http://localhost:9200/_cluster/health
--------------------------------------------------
// NOTCONSOLE

The following example obtains a token for the `test_admin` user using the
`password` grant type:

[source,js]
--------------------------------------------------
POST /_security/oauth2/token
{
  "grant_type" : "password",
  "username" : "test_admin",
  "password" : "<PASSWORD>"
}
--------------------------------------------------
// CONSOLE

The following example output contains the access token, the amount of time (in
seconds) that the token expires in, the type, and the refresh token:

[source,js]<commit_msg>Enhance Get Tokens API docs (#45104)<commit_after>[role="xpack"]
[[security-api-get-token]]
=== Get token API
++++
<titleabbrev>Get token</titleabbrev>
++++

Creates a bearer token for access without requiring basic authentication.

[[security-api-get-token-request]]
==== {api-request-title}

`POST /_security/oauth2/token` 


[[security-api-get-token-desc]]
==== {api-description-title}

The tokens are created by the {es} Token Service, which is automatically enabled
when you configure TLS on the HTTP interface. See <<tls-http>>. Alternatively,
you can explicitly enable the `xpack.security.authc.token.enabled` setting. When 
you are running in production mode, a bootstrap check prevents you from enabling 
the token service unless you also enable TLS on the HTTP interface. 

The get token API takes the same parameters as a typical OAuth 2.0 token API
except for the use of a JSON request body.

A successful get token API call returns a JSON structure that contains the access
token, the amount of time (seconds) that the token expires in, the type, and the
scope if available.

The tokens returned by the get token API have a finite period of time for which
they are valid and after that time period, they can no longer be used. That time
period is defined by the `xpack.security.authc.token.timeout` setting. For more
information, see <<token-service-settings>>.

If you want to invalidate a token immediately, you can do so by using the 
<<security-api-invalidate-token,invalidate token API>>.

Using the Get Token API requires the `manage_token` cluster privilege.

==== Grant Types

Grant type `password` implements the Resource Owner Password Credentials Grant
of OAuth2. In this grant, a trusted client exchanges the end user's credentials
for an access token and (possibly) a refresh token. The request needs to be made
by an authenticated user but happens _on behalf_ of another authenticated user, the
one whose credentials are passed as request parameters. This grant type is
not suitable or designed for self-service user creation of tokens.

Grant type `client_credentials` implements the Client Credentials Grant of
OAuth2. This grant type is geared for machine to machine communication and is not
suitable or designed for self-service user creation of tokens. It will only
generate access tokens that cannot be refreshed as the premise is that the
entity that uses `client_credentials` has constant access to a set of
(client, not end-user) credentials and can authenticate itself at will. 

[[security-api-get-token-request-body]]
==== {api-request-body-title}

The following parameters can be specified in the body of a POST request and
pertain to creating a token:

`grant_type`::
(string) The type of grant. Supported grant types are: `password`, `_kerberos`,
`client_credentials` and `refresh_token`. The `_kerberos` grant type
is supported internally and implements SPNEGO based Kerberos support. The `_kerberos`
grant type may change from version to version.

`password`::
(string) The user's password. If you specify the `password` grant type, this 
parameter is required. This parameter is not valid with any other supported
grant type.

`kerberos_ticket`::
(string) base64 encoded kerberos ticket. If you specify the `_kerberos` grant type,
this parameter is required. This parameter is not valid with any other supported
grant type.

`refresh_token`::
(string) If you specify the `refresh_token` grant type, this parameter is 
required. It contains the string that was returned when you created the token 
and enables you to extend its life. This parameter is not valid with any other
supported grant type.

`scope`::
(string) The scope of the token. Currently tokens are only issued for a scope of
`FULL` regardless of the value sent with the request.

`username`::
(string) The username that identifies the user. If you specify the `password` 
grant type, this parameter is required. This parameter is not valid with any
other supported grant type.

[[security-api-get-token-example]]
==== {api-examples-title}

The following example obtains a token using the `client_credentials` grant type,
which simply creates a token as the authenticated user:

[source,js]
--------------------------------------------------
POST /_security/oauth2/token
{
  "grant_type" : "client_credentials"
}
--------------------------------------------------
// CONSOLE

The following example output contains the access token, the amount of time (in
seconds) that the token expires in, and the type:

[source,js]
--------------------------------------------------
{
  "access_token" : "<KEY>
  "type" : "Bearer",
  "expires_in" : 1200
}
--------------------------------------------------
// TESTRESPONSE[s/<KEY>/$body.access_token/]

The token returned by this API can be used by sending a request with a
`Authorization` header with a value having the prefix `Bearer ` followed
by the value of the `access_token`.

[source,shell]
--------------------------------------------------
curl -H "Authorization: Bearer dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==" http://localhost:9200/_cluster/health
--------------------------------------------------
// NOTCONSOLE

The following example obtains a token for the `test_admin` user using the
`password` grant type. This request needs to be made by an authenticated user with sufficient privileges that may
or may not be the same as the one whose username is passed in the `username` parameter:

[source,js]
--------------------------------------------------
POST /_security/oauth2/token
{
  "grant_type" : "password",
  "username" : "test_admin",
  "password" : "<PASSWORD>"
}
--------------------------------------------------
// CONSOLE

The following example output contains the access token, the amount of time (in
seconds) that the token expires in, the type, and the refresh token:

[source,js]
{'fraction_non_alphanumeric': 0.14746847355543008, 'fraction_numerical': 0.005740636175418784, 'mean_word_length': 3.2559070885062074, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '250773', 'n_tokens_mistral': 2892, 'n_tokens_neox': 2782, 'n_words': 1307}