Create JWT

Issues a JWT access token and a refresh token. One endpoint serves four grants, and the fields you send pick the grant. Every grant requires HTTPS; a plain HTTP request returns 403.

Send grant_type password, the user's username and password, and your OAuth client credentials, in the body or as an HTTP Basic Authorization header. No bearer token is needed. A wrong username or password returns 403. A domain that requires single sign-on returns 405: use the SSO flow instead.

If the user has MFA enabled, or the domain requires an authenticator app, the returned token has the user_scope claim mfa_required. It expires in 5 minutes and is good only for Complete MFA. The refresh token from that response cannot be used.

Complete MFA

Send grant_type mfa, the pending token as access_token, the 6-digit passcode and ns_id_type. Also include password, because this endpoint picks the grant by that field, although this grant does not check its value. A wrong passcode returns 401: ask the user for a fresh code. An expired pending token returns 401 [OA080]: log in again. The pending token is single-use: once a passcode has been accepted for it, any further mfa grant with the same token returns 401 Pre-MFA token already used, and a pending token that carries no jti returns 401 Invalid pre-MFA token.

Refresh

Send refresh on its own. No client credentials are needed. The refresh token you send is revoked on use, so keep the new refresh from the response. The revocation is an atomic claim: if two exchanges of the same refresh token race, exactly one succeeds and the other returns 401 Refresh token already used. The new token picks up changes to the user's email, avatar or department since login. A token issued while MFA was pending returns 401.

Delegated (API key)

Send an API key as Authorization: Bearer <key>, and name the user with user and domain. The key must be allowed to create tokens and must have update rights on the user. A Super User key can issue tokens for any user; any other key only for its own user or a user with a lower scope. The issued token records the key's ID in its mask_chain claim. A JWT bearer instead of an API key returns 403.

application/json

A JWT access token and its refresh token. After a password login that still needs MFA, token is a 5-minute pending token.

Bodyapplication/json

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/jwt' \ --header 'Content-Type: application/json' \ --data-raw '{ "grant_type": "password", "client_id": "", "client_secret": "", "username": "1001@example.com", "password": "{{user_password}}" }'

Complete MFA

Refresh

Delegated (API key)

Request

Responses

Create JWT

Password login#

Complete MFA#

Refresh#

Delegated (API key)#

Request

Responses

Password login

Complete MFA

Refresh

Delegated (API key)