Create JWT

POST

/jwt

Last modified:2026-10-30 21:19:35

OperationId:CreateJwt

Issues a JWT access token and refresh token for the grant that the fields you send select. Every grant requires HTTPS.

Password login: send grant_type password, the user's username and password, and your OAuth client credentials. No bearer token is needed. A user with MFA gets a 5-minute pending token that only Complete MFA accepts.

Complete MFA: send grant_type mfa, the pending token as access_token, and the passcode from the user's authenticator app.

Refresh: send refresh on its own to get a new token pair.

Delegated: authenticate with an API key that can create tokens, and name the user with user and domain.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

A JWT access token and its refresh token. After a password login that still needs MFA, token is a 5-minute pending token.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🟠405Method Not Allowed

Request Example

Shell

JavaScript

Java

Swift

cURL

Password loginComplete MFARefreshDelegated (API key)

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/jwt' \
--header 'Content-Type: application/json' \
--data-raw '{
    "grant_type": "password",
    "client_id": "",
    "client_secret": "",
    "username": "1001@example.com",
    "password": "{{user_password}}"
}'

Response Example

200 - Password login

Full token pair

{
    "token": "{{access_jwt}}",
    "refresh": "{{refresh_jwt}}"
}

Modified at 2026-10-30 21:19:35

Get API key

Revoke JWTs