Get JWT from OAuth grant

POST

/authCode

Last modified:2026-09-26 01:50:15

OperationId:GetAccessTokenAuthCode

Runs an OAuth grant and returns a JWT access token and JWT refresh token instead of the opaque tokens that POST /tokens returns. It is the same call as POST /netsapiensjs. No bearer token is needed. The request must arrive over HTTPS. Send the client_id and client_secret of an OAuth client in the body, or as HTTP Basic credentials in the Authorization header. It accepts the same grant_type values as POST /tokens, including password and authorization_code. When the user still needs MFA, the response carries scope mfa_required and a limited token: send it as access_token to POST /tokens with grant_type mfa. The response also sets the ns_access_token and ns_refresh_token cookies. A plain HTTP request returns 403. Missing or invalid client credentials return 401.

Request

Body Params application/json

Examples

Responses

🟢200OK

application/json

Grant accepted. The body holds token and refresh, or a limited token with scope mfa_required.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🟠405Method Not Allowed

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/authCode' \
--header 'Content-Type: application/json' \
--data '{
    "grant_type": "password",
    "client_id": "",
    "client_secret": "",
    "username": "{{username}}",
    "password": "{{password}}"
}'

Response Example

200 - Login complete

{
    "token": "{{jwt_access_token}}",
    "refresh": "{{jwt_refresh_token}}",
    "auth_requirement": "login_name_and_password",
    "allow_user_primary_email_edit": false,
    "account_recovery_user_primary_email": false,
    "email": "user@example.com",
    "domain": "example.com"
}

Modified at 2026-09-26 01:50:15

Get access token

Link SSO identity to user