---
title: "Obtain authentication token"
type: reference
method: POST
path: /rest-api/auth/token.do
tag: "Authentication"
---

# Obtain authentication token

`POST https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do`

Step 1 of the two-step login flow. Validates the provided username and password, then returns a one-time authentication token that can be used with GET /rest-api/auth/{authToken}/login.do to establish a session. The token is valid for one minute and is invalidated after a single use. Requires HTTPS unless the network allows this login over plain HTTP. On success, the response JSON contains 'authToken' (the token string) and 'role' (the user's ACL role name). IP whitelist checks and brute-force protection are enforced: repeated failures are temporarily refused. An unknown username, a wrong password, an inactive account and an address outside the whitelist all get the same answer.

## Form params

| Name | Type | Required | Example | Description |
|---|---|---|---|---|
| `username` | string | yes | `john.doe` | The username of the account to authenticate. Must correspond to an existing active user. |
| `password` | string | yes | `s3cur3P@ss` | The user's password. |

## Responses

- `200` — Token generated successfully. Response JSON: {success: true, authToken: '...', role: '...'}.
- `400` — Bad request — invalid or missing parameters
- `401` — Wrong username or password, an address outside the user's IP whitelist, or too many failed attempts: {success: false, error: '...', authToken: ''}.
- `403` — Plain HTTP where the server requires HTTPS: {success: false, error: '...'}.

## Example request

```bash
curl --request POST \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/auth/token.do' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'username=john.doe' \
  --data-urlencode 'password=s3cur3P@ss'
```

Source: https://epom.com/ad-server/docs/api/authentication/post-auth-token