> ## Documentation Index
> Fetch the complete documentation index at: https://higginsgraferinc.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate user and obtain access token

> Exchange the user's username and password for an access token. 

The client ID and client secret are used for client authentication (basic). Certain endpoints require the access token in the Authorization header to perform admin functions, like creating menus. 

If an existing access token is associated with the user, it will be invalidated before a new one is generated.




## OpenAPI

````yaml openapi.yaml post /auth/token
openapi: 3.0.3
info:
  title: Point of Service (POS) API
  version: '1.0'
  description: >
    An example of a restaurant point of sale API, used to learn how to make API
    calls using Swagger, Github codespaces, and Postman, and to learn API
    documentation best practices.
  contact:
    name: Course Discord server
    url: https://discord.gg/dPsnz5u9
    email: mark.wentowski@docsgeek.io
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
  - url: https://reimagined-journey-g45xxv4v6gwhvrrr-80.app.github.dev
    description: The server URL used for the point of service API
    variables:
      gh-codespaces-server-url:
        default: https://reimagined-journey-g45xxv4v6gwhvrrr-80.app.github.dev
        description: >-
          Codespace URL used by Sarah Holdgrafer for Mastering API Documentation
          course.
  - url: http://localhost:80/
    description: Local URL for testing
security: []
tags:
  - name: Orders
    description: Methods for creating and managing orders in the client app.
  - name: Dishes
    description: Methods for creating and managing dishes in the client app.
  - name: Ingredients
    description: Methods used for creating and managing ingredients in the client app .
  - name: Users
    description: >-
      Methods for creating and managing the user accounts allowed to access the
      client app.
  - name: Auth
    description: Authentication endpoints for the client app (all methods use Basic auth).
paths:
  /auth/token:
    post:
      tags:
        - Auth
      summary: Authenticate user and obtain access token
      description: >
        Exchange the user's username and password for an access token. 


        The client ID and client secret are used for client authentication
        (basic). Certain endpoints require the access token in the Authorization
        header to perform admin functions, like creating menus. 


        If an existing access token is associated with the user, it will be
        invalidated before a new one is generated.
      operationId: postAuthLogin
      requestBody:
        $ref: '#/components/requestBodies/CreateTokenRequest'
      responses:
        '201':
          description: >-
            Resource created successfully. The response body contains the newly
            created resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Auth'
          headers:
            Location:
              schema:
                type: string
              description: ...
        '400':
          description: Invalid request
        '409':
          description: Unable to complete request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      security:
        - BasicAuth: []
components:
  requestBodies:
    CreateTokenRequest:
      description: >
        The request body to create a token requires the following properties:
        `grant_type`, `user_name`, and `password`.
      required: true
      content:
        application/json:
          schema:
            properties:
              grant_type:
                type: string
                description: >-
                  Tells the login endpoint to perform the resource owner
                  password credential flow.
                example: password
              user_name:
                $ref: '#/components/schemas/UserName'
              password:
                $ref: '#/components/schemas/Password'
            required:
              - grant_type
              - user_name
              - password
  schemas:
    Auth:
      type: object
      description: |
        The response object returned for both `/auth` endpoints.
      properties:
        auth_id:
          $ref: '#/components/schemas/Id'
        created_at:
          $ref: '#/components/schemas/CreatedAt'
        updated_at:
          $ref: '#/components/schemas/UpdatedAt'
        access_token:
          $ref: '#/components/schemas/AccessToken'
        expires_at:
          $ref: '#/components/schemas/ExpiresAt'
        refresh_token:
          $ref: '#/components/schemas/RefreshToken'
        token_type:
          $ref: '#/components/schemas/TokenType'
        user_name:
          $ref: '#/components/schemas/UserName'
    Problem:
      type: object
      properties:
        title:
          type: string
          description: >-
            A short summary of the error or problem encountered with the
            request.
          example: Human-readable error title.
        detail:
          type: string
          description: >-
            A more detailed description of the error or problem to indicate the
            source and the solution, if possible.
          example: Human-readable error details.
      required:
        - title
        - detail
    UserName:
      type: string
      description: >-
        The user name for account login purposes. User names cannot contain
        spaces.
      example: john_doe
    Password:
      type: string
      description: >-
        Passwords must be at least eight characters long and contain at least
        one uppercase letter, one lowercase letter, one digit, and one special
        character (@, $, !, %, *, ?, &).
      example: P@ssw0rd!
    Id:
      type: string
      example: 674d0bf5c28b69001f8e03a1
      readOnly: true
      description: >
        A unique alpha-numeric string generated by the system when creating a
        resource (e.g., dishes, ingredients, etc). Ids are required for
        retrieving the properties of a specific resource.
    CreatedAt:
      type: string
      format: date-time
      example: '2024-04-22T10:00:00Z'
      readOnly: true
      description: >
        The date and time the resource was created. Timestamp uses ISO 8601
        format, Ex: `2025-04-05T14:55:03.824Z` 
    UpdatedAt:
      type: string
      format: date-time
      example: '2024-04-22T10:00:00Z'
      readOnly: true
      description: |
        The date and time the resource was last updated. 

        Timestamp uses ISO 8601 format, Ex: `2025-04-05T14:55:03.824Z` 
    AccessToken:
      type: string
      description: >
        An alpha-numeric string generated when authenicating a user and required
        for protected endpoints. 


        Expires after ### seconds.
      example: fa0b97b2-445f-41d2-b50f-fb3b014a301e
    ExpiresAt:
      type: string
      format: date-time
      example: '2024-04-22T10:00:00Z'
      readOnly: true
      description: >
        Indicates when a token expires and should be refreshed to maintain a
        user's authentication. Timestamp uses ISO 8601 format, Ex:
        `2025-04-05T14:55:03.824Z` 
    RefreshToken:
      type: string
      description: >-
        The alpha-numeric refresh token value, used to re-authenticate a user
        after the authentication token expires.
      example: d1a3e281-96b6-4f77-a587-7b6c8c2a96d9
    TokenType:
      type: string
      description: The type of token used in an `/auth` request.
      example: Bearer
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
      description: The auth type used by all protected endpoints.

````