---
updatedAt: 2026-05-13T19:25:47.000Z
---

Fetch the complete documentation index at: https://developers.pismo.io/pismo-docs/llms.txt. Use this file to discover all available pages before exploring further.

# Get OpenID access token

Get an access token for OpenID authentication

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The JWT must be signed using the RS256 algorithm with your server's private key, and include specific claims as outlined in [Authentication with OpenID Connect](doc:authentication-with-openid).

**Note**: Many of the endpoints in the Pismo API require you to pass a JWT that you generated which includes a Pismo account ID (`uid` or `account_id`) or an account ID from an external system used in place of the Pismo account ID (`external_account_id`). Further calls to Pismo endpoints will require this token in the Authorization header.
 
 For more information about account-specific tokens, refer to [Endpoints that require an account-specific token](ref:endpoints-that-require-an-account-specific-token) and [Endpoints that require an external ID-specific token](ref:endpoints-that-require-an-external-id-token).


# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "Platform authentication",
    "version": "2.0.0",
    "description": "API to handle authentication and user management.<br/><br/>",
    "contact": {
      "name": "API Support",
      "url": "https://developers.pismo.io/support/"
    },
    "license": {
      "name": "Copyright Pismo"
    }
  },
  "servers": [
    {
      "url": "https://sandbox.pismolabs.io/passport",
      "description": "Sandbox API server for testing"
    },
    {
      "url": "https://sandbox.pismolabs.io/passport",
      "description": "Sandbox API for oauth2"
    }
  ],
  "components": {
    "schemas": {
      "SimpleError": {
        "title": "SimpleError",
        "type": "object",
        "properties": {
          "message": {
            "type": "string",
            "description": "Message describing the error"
          },
          "examples": {}
        },
        "required": [
          "message"
        ]
      }
    }
  },
  "tags": [
    {
      "name": "Authentication",
      "description": "Endpoints for obtaining an access token"
    }
  ],
  "paths": {
    "/v1/oauth2/token": {
      "post": {
        "summary": "Get OpenID access token",
        "operationId": "post-passport-v1-oauth2-token",
        "description": "Get an access token for OpenID authentication\n\nA JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The JWT must be signed using the RS256 algorithm with your server's private key, and include specific claims as outlined in [Authentication with OpenID Connect](https://developers.pismo.io/pismo-docs/docs/authentication-with-openid).\n\n**Note**: Many of the endpoints in the Pismo API require you to pass a JWT that you generated which includes a Pismo account ID (`uid` or `account_id`) or an account ID from an external system used in place of the Pismo account ID (`external_account_id`). Further calls to Pismo endpoints will require this token in the Authorization header.\n \n For more information about account-specific tokens, refer to [Endpoints that require an account-specific token](https://developers.pismo.io/pismo-docs/reference/endpoints-that-require-an-account-specific-token) and [Endpoints that require an external ID-specific token](https://developers.pismo.io/pismo-docs/reference/endpoints-that-require-an-external-id-token).\n",
        "tags": [
          "Authentication"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "token"
                ],
                "properties": {
                  "token": {
                    "type": "string",
                    "description": "JSON Web Token (JWT) created using the RS256 algorithm and including the required claims as outlined in [Authentication with OpenID Connect](https://developers.pismo.io/pismo-docs/docs/authentication-with-openid). For more information, refer to [Generating a JWT](https://developers.pismo.io/pismo-docs/docs/authentication-with-openid#generate-your-jwt)."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Created",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "token": {
                      "type": "string",
                      "description": "Pismo-signed JWT used to make authenticated requests"
                    },
                    "refresh_token": {
                      "type": "string",
                      "description": "JWT used to refresh an expired Pismo access token"
                    },
                    "expires_in": {
                      "type": "string",
                      "description": "Expiration time (in seconds) for the Pismo access token",
                      "example": "3600"
                    }
                  }
                },
                "examples": {
                  "Logged-in server": {
                    "value": {
                      "expires_in": "3600"
                    }
                  }
                }
              }
            },
            "headers": {}
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SimpleError"
                },
                "examples": {
                  "Bad credentials": {
                    "value": {
                      "message": "Invalid credentials"
                    }
                  }
                }
              }
            }
          },
          "500": {
            "description": "Internal Server Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SimpleError"
                },
                "examples": {
                  "Internal error": {
                    "value": {
                      "message": "Error authenticating server"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
```