> This page is for Multi-Tenant, version v3.0 (default).
> For other versions, use one of these documentation indexes:
> - v3.0 (default): https://docs.nvidia.com/run-ai/multi-tenant/v3.0/llms.txt
> - v2.26: https://docs.nvidia.com/run-ai/multi-tenant/v2.26/llms.txt
> - v2.25: https://docs.nvidia.com/run-ai/multi-tenant/v2.25/llms.txt
> - v2.24: https://docs.nvidia.com/run-ai/multi-tenant/v2.24/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server.

# Create an access token v2

POST http://localhost:8080/api/v2/token
Content-Type: application/x-www-form-urlencoded

Use this endpoint to obtain an access token. Compliant with standard OAuth2 protocol and supports the common OAuth2 grant types.


Reference: https://docs.nvidia.com/run-ai/multi-tenant/reference/rest-api/endpoints/authentication-and-authorization/tokens/grant-token-v-2

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication

## Request

### Body (application/x-www-form-urlencoded)

This endpoint expects an object.

- `grant_type` (enum, required) — The OAuth2 grant type. Determines the authentication flow and which parameters are required: `client_credentials` - Authenticate as a service account or user access key using clientId and clientSecret. `password` - Authenticate as a local user using username and password. `external_token_exchange` - Authenticate as a service account or user using a token issued by the configured identity provider (IdP) for a Run:ai token. Requires externalToken.
  - Allowed values: `client_credentials`, `password`, `external_token_exchange`
- `client_id` (string, optional) — The client identifier for a service account or user access key. Required when using the client_credentials grant type. Must be used together with clientSecret.
- `client_secret` (string, optional) — The client secret corresponding to the clientId. Required when using the client_credentials grant type. Must be used together with clientId.
- `username` (string, optional) — The username of a local user account. Required when using the password grant type. Must be used together with password.
- `password` (string, optional) — The password for the specified username. Required when using the password grant type. Must be used together with username.
- `external_token` (string, optional) — A valid token issued by the identity provider (IdP) that is configured in NVIDIA Run:ai. Required when using the external_token_exchange grant type.

## Response

### 200

Successfully issued token

- `access_token` (string, required) — The access token issued by the authorization server
- `token_type` (string, required) — The type of the token issued (typically "Bearer")
- `expires_in` (integer, optional) — The lifetime in seconds of the access token
- `refresh_token` (string, optional) — The refresh token, which can be used to obtain new access tokens
- `id_token` (string, optional) — ID Token value associated with the authenticated session (OpenID Connect)
- `scope` (string, optional) — The scope of the access token

## Errors

### 400 Bad Request Error

Invalid request

- `error` (enum, required) — A single ASCII error code
  - Allowed values: `invalid_request`, `invalid_client`, `invalid_grant`, `unauthorized_client`, `unsupported_grant_type`, `invalid_scope`, `server_error`, `temporarily_unavailable`
- `error_description` (string, optional) — Human-readable ASCII text providing additional information
- `error_uri` (string, optional) — URI identifying a human-readable web page with information about the error

### 401 Unauthorized Error

Client authentication failed

- `error` (enum, required) — A single ASCII error code
  - Allowed values: `invalid_request`, `invalid_client`, `invalid_grant`, `unauthorized_client`, `unsupported_grant_type`, `invalid_scope`, `server_error`, `temporarily_unavailable`
- `error_description` (string, optional) — Human-readable ASCII text providing additional information
- `error_uri` (string, optional) — URI identifying a human-readable web page with information about the error

### 500 Internal Server Error

unexpected error

- `code` (integer, required)
- `message` (string, required)
- `details` (string, optional)

### 503 Service Unavailable Error

unexpected error

- `code` (integer, required)
- `message` (string, required)
- `details` (string, optional)

## Examples

### Tokens_grant_token_v2_example

**Response**

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

**SDK Code**

```python Tokens_grant_token_v2_example
import requests

url = "http://localhost:8080/api/v2/token"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.json())
```

```javascript Tokens_grant_token_v2_example
const url = 'http://localhost:8080/api/v2/token';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Tokens_grant_token_v2_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:8080/api/v2/token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Tokens_grant_token_v2_example
require 'uri'
require 'net/http'

url = URI("http://localhost:8080/api/v2/token")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java Tokens_grant_token_v2_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("http://localhost:8080/api/v2/token")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php Tokens_grant_token_v2_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'http://localhost:8080/api/v2/token', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Tokens_grant_token_v2_example
using RestSharp;

var client = new RestClient("http://localhost:8080/api/v2/token");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift Tokens_grant_token_v2_example
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v2/token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### client_credentials

**Request**

```json
{
  "grant_type": "client_credentials",
  "client_id": "my-client-id",
  "client_secret": "my-client-secret"
}
```

**Response**

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

**SDK Code**

```python client_credentials
import requests

url = "http://localhost:8080/api/v2/token"

payload = ""
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.post(url, data=payload, headers=headers)

print(response.json())
```

```javascript client_credentials
const url = 'http://localhost:8080/api/v2/token';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams('')
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go client_credentials
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:8080/api/v2/token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby client_credentials
require 'uri'
require 'net/http'

url = URI("http://localhost:8080/api/v2/token")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/x-www-form-urlencoded'

response = http.request(request)
puts response.read_body
```

```java client_credentials
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("http://localhost:8080/api/v2/token")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/x-www-form-urlencoded")
  .asString();
```

```php client_credentials
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'http://localhost:8080/api/v2/token', [
  'form_params' => null,
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/x-www-form-urlencoded',
  ],
]);

echo $response->getBody();
```

```csharp client_credentials
using RestSharp;

var client = new RestClient("http://localhost:8080/api/v2/token");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
IRestResponse response = client.Execute(request);
```

```swift client_credentials
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/x-www-form-urlencoded"
]

let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v2/token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### password

**Request**

```json
{
  "grant_type": "password",
  "client_id": "my-client-id",
  "username": "user@example.com",
  "password": "password123"
}
```

**Response**

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

**SDK Code**

```python password
import requests

url = "http://localhost:8080/api/v2/token"

payload = ""
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.post(url, data=payload, headers=headers)

print(response.json())
```

```javascript password
const url = 'http://localhost:8080/api/v2/token';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams('')
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go password
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:8080/api/v2/token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby password
require 'uri'
require 'net/http'

url = URI("http://localhost:8080/api/v2/token")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/x-www-form-urlencoded'

response = http.request(request)
puts response.read_body
```

```java password
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("http://localhost:8080/api/v2/token")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/x-www-form-urlencoded")
  .asString();
```

```php password
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'http://localhost:8080/api/v2/token', [
  'form_params' => null,
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/x-www-form-urlencoded',
  ],
]);

echo $response->getBody();
```

```csharp password
using RestSharp;

var client = new RestClient("http://localhost:8080/api/v2/token");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
IRestResponse response = client.Execute(request);
```

```swift password
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/x-www-form-urlencoded"
]

let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v2/token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### external_token_exchange

**Request**

```json
{
  "grant_type": "external_token_exchange",
  "client_id": "my-client-id",
  "external_token": "access_token_from_external_idp"
}
```

**Response**

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

**SDK Code**

```python external_token_exchange
import requests

url = "http://localhost:8080/api/v2/token"

payload = ""
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.post(url, data=payload, headers=headers)

print(response.json())
```

```javascript external_token_exchange
const url = 'http://localhost:8080/api/v2/token';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams('')
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go external_token_exchange
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "http://localhost:8080/api/v2/token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby external_token_exchange
require 'uri'
require 'net/http'

url = URI("http://localhost:8080/api/v2/token")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/x-www-form-urlencoded'

response = http.request(request)
puts response.read_body
```

```java external_token_exchange
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("http://localhost:8080/api/v2/token")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/x-www-form-urlencoded")
  .asString();
```

```php external_token_exchange
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'http://localhost:8080/api/v2/token', [
  'form_params' => null,
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/x-www-form-urlencoded',
  ],
]);

echo $response->getBody();
```

```csharp external_token_exchange
using RestSharp;

var client = new RestClient("http://localhost:8080/api/v2/token");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
IRestResponse response = client.Execute(request);
```

```swift external_token_exchange
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/x-www-form-urlencoded"
]

let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v2/token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```