---
title: "Generate a JSON Web Token (JWT)"
url: "https://developer-beta.morningstar.com/apis/authentication-api/versions/b873763c-2aca-461a-b088-d0841248e769/operations/createToken"
---

> Full API specification: https://developer-beta.morningstar.com/apis/authentication-api/versions/b873763c-2aca-461a-b088-d0841248e769.md

# Generate a JSON Web Token (JWT)

`POST` `/token/oauth`

Operation ID: `createToken`

Authenticates a client using HTTP Basic authentication and returns a signed JWT bearer token for use in subsequent API requests. Pass your client ID and secret as a Base64-encoded `client_id:client_secret` string in the `Authorization` header. Include the returned `access_token` as a `Bearer` token on subsequent requests.

## Request body (required)

Content types: `application/x-www-form-urlencoded`

## Responses

- `200` - 200: OK
- `401` - 401: Unauthorized

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Authentication API
  version: "1.0"
servers:
  - url: https://www.us-stg-api.morningstar.com
    description: Americas Production
  - url: https://www.apac-stg-api.morningstar.com
    description: APAC Production
  - url: https://www.emea-stg-api.morningstar.com
    description: EMEA Production
paths:
  /token/oauth:
    post:
      summary: Generate a JSON Web Token (JWT)
      operationId: createToken
      tags:
        - Token
      description: >-
        Authenticates a client using HTTP Basic authentication and returns a
        signed JWT bearer token for use in subsequent API requests.

        Pass your client ID and secret as a Base64-encoded
        `client_id:client_secret` string in the `Authorization` header. Include
        the returned `access_token` as a `Bearer` token on subsequent requests.
      security:
        - basicAuth: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
              properties:
                grant_type:
                  type: string
                  enum:
                    - client_credentials
      responses:
        "200":
          $ref: "#/components/responses/ResponseToken"
        "401":
          $ref: "#/components/responses/ErrorResponse401"
security:
  - basicAuth: []
components:
  responses:
    ResponseToken:
      description: "200: OK"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/OutputToken"
          examples:
            ResponseTokenExample1:
              $ref: "#/components/examples/ResponseTokenExample1"
    ErrorResponse401:
      description: "401: Unauthorized"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponse"
          examples:
            ErrorResponseExample1: ""
  schemas:
    OutputToken:
      type: object
      description: A successful authentication response containing a JWT bearer token.
      required:
        - access_token
        - expires_in
        - token_type
      properties:
        access_token:
          type: string
          description: The signed JWT to use as a `Bearer` token in subsequent
            authenticated requests.
          examples:
            - eyJhbGciOiJ example
        expires_in:
          type: integer
          description: The number of seconds until the token expires. After expiry,
            request a new token.
          examples:
            - 3599
        token_type:
          type: string
          description: The token type. Always `Bearer`.
          examples:
            - Bearer
    ErrorResponse:
      type: object
      description: A response body returned when an error occurs.
      required:
        - error_message
      properties:
        error_message:
          type: string
          description: A human-readable description of the error.
          examples:
            - Incorrect username or password
  examples:
    ResponseTokenExample1:
      summary: Output Authorization Token
      value:
        access_token: Rhci5jb20vaW50ZXJuYWxfY29tcGFueV9pZCI6IkNsaWVudDAiLCJodHRwczovL21vcm5pbmdzdGFyLmNvbS9kYXRhX3JvbGUiOlsiU2VhcmNoLkFDSURfU2VydmljZSJdLCJodHRwczovL21vcm5pbmdzdGFyLmNvbS9jb25maWdfaWQiOiJnbG9iYWxfYWRtaW5fYXBpcy4wMDFkMDAwMDAweDU5YjcuMjA2OTg0MzZfd2twbGMxaDciLCJodHRwczovL21vcm5pbmdzdGFyLmNvbS9tc3Rhcl9pZCI6IkZFMTUzOEM4LTg0RDMtNDlCRC05MzNELTdGQkEyOERGODAzMyIsImh0dHBzOi8vbW9ybmluZ3N0YXIuY29tL2VtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiaHR0cHM6Ly9tb3JuaW5nc3Rhci5jb20vcGFzc3dvcmRDaGFuZ2VSZXF1aXJlZCI6ZmFsc2UsImh0dHBzOi8vbW9ybmluZ3N0YXIuY29tL3VpbV9yb2xlcyI6IkVBTVMsSU5WRVNUTUVOVEFQSV9JTlRFUk5BTF9TRVJWSUNFX0FDQ09VTlQiLCJpc3MiOiJodHRwczovL2xvZ2luLXByb2QubW9ybmluZ3N0YXIuY29tLyIsInN1YiI6ImF1dGgwfEZFMTUzOEM4LTg0RDMtNDlCRC05MzNELTdGQkEyOERGODAzMyIsImF1ZCI6WyJodHRwczovL2F1dGgwLWF3c3By
        expires_in: 3599
        token_type: Bearer
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: >-
        HTTP Basic authentication using your API credentials.


        - **Username** — your `client_id`

        - **Password** — your `client_secret`


        Enter these values in the `Username` and `Password` fields to authorise
        requests from this page.


        The credentials are Base64-encoded into the `Authorization` header on
        your behalf.
```