Get access token

Issues an OAuth access token and refresh token. One endpoint serves every grant, and grant_type picks it. No bearer token is needed. Send the client_id and client_secret of an OAuth client in the body, or as HTTP Basic credentials in the Authorization header. The response also sets the ns_access_token and ns_refresh_token cookies.

Send grant_type password with the user's username (matched against the login name) and password. A wrong login name or password returns 403 by default. A domain that requires single sign-on returns 405: use an SSO grant instead.

When the user has MFA enabled, or the domain requires an authenticator app, the response has scope mfa_required, an access_token that expires in 600 seconds, and no refresh_token. Finish the login with Complete MFA.

Complete MFA

Send grant_type mfa, the limited access_token, the 6-digit passcode from the user's authenticator app, and ns_id_type. The server reads only those fields for this grant, and client credentials are optional. The passcode is checked with a tolerance of about 60 seconds either way. A wrong passcode returns 401. An unknown limited token returns 400: start again with the password grant. The limited token is single-use: once a passcode has been accepted for it, any further mfa grant with the same token returns 401 Pre-MFA token already used, and a limited JWT that carries no jti returns 401 Invalid pre-MFA token.

Refresh

Send grant_type refresh_token and the refresh_token. It can be the opaque token from this endpoint or a JWT refresh token from POST /authCode. A JWT refresh token is revoked after one use by default, and the claim is atomic: if two exchanges of the same refresh token race, exactly one succeeds and the other returns 401 Refresh token already used. An opaque refresh token stays valid until it expires, 4 days after issue by default. An unknown refresh token returns 400, and an expired one returns 401: log in again.

Other grants

grant_type also accepts authorization_code, google, office, apple, oidc, masquerade, delegated, guest and chat_guest. Any other value returns 400.

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/tokens' \ --header 'Content-Type: application/json' \ --data-raw '{ "grant_type": "password", "client_id": "", "client_secret": "", "username": "1001@example.com", "password": "{{user_password}}" }'

{ "username": "1000@example.com", "user": "1000", "territory": "example-reseller", "domain": "example.com", "site": "Main", "group": "Main", "department": "Sales", "uid": "1000@example.com", "login": "1000@example.com", "scope": "Office Manager", "user_email": "user@example.com", "displayName": "Front Desk", "access_token": "{{access_token}}", "expires_in": 3600, "token_type": "Bearer", "refresh_token": "{{refresh_token}}", "client_id": "{{client_id}}", "apiversion": "46.0.0" }

Complete MFA

Refresh

Other grants

Request

Responses

Get access token

Password login#

Complete MFA#

Refresh#

Other grants#

Request

Responses

Password login

Complete MFA

Refresh

Other grants