Create an access token

Exchanges an API key for a short-lived access token that every other request carries. The key in the body is the credential, so this call sends no Authorization header of its own.

Body

application/json

keystringrequired

The whole API key, magic_ prefix included. Treat the entire string as the secret: send it in the body, never in a query string, and never split it into parts.

example: magic_1830472847398404096_Xk3nQv8mWp2sT5yR9dL4bN6hJ1kF3gZ7xC0vQ8aE

Response

200 · A new access token

accessTokenstring

The token to send as Authorization: Bearer <accessToken> on every other request.

tokenTypestring

The scheme to use in the Authorization header. Always Bearer.

example: Bearer

expiresIninteger

How many seconds the access token stays valid. 900, which is fifteen minutes. Exchange the key again a little early rather than waiting for a 401 and retrying.

example: 900

401 · The key was not accepted

Every failure is the same 401

A malformed key, an unknown key, a revoked key, an expired key, a wrong secret, a user who has been deactivated, a user who has moved to another company, a company that has been banned, and a key left with no permissions after being narrowed to its user all return the identical response. The real reason goes to MagicDoor's logs and never to the caller, so someone probing keys learns nothing from the answer.

There is no refresh token. The API key is the durable credential, so when the access token runs out you call this endpoint again with the same key. See Authentication for how keys are issued and scoped.