# Create an access token

Source: https://api-docs.magicdoor.com/api-reference/api-key-tokens/create-token

Exchanges an API key for a short-lived access token that every other request carries. The key in the body is the credential, so this call sends no Authorization header of its own.

`POST https://auth.magicdoor.com/api-keys/token`

**Authentication:** none.

## Body

Content type: `application/json`

- `key` (string, required) — The whole API key, `magic_` prefix included. Treat the entire string as the secret: send it in the body, never in a query string, and never split it into parts. Example: `magic_1830472847398404096_Xk3nQv8mWp2sT5yR9dL4bN6hJ1kF3gZ7xC0vQ8aE`.

```json
{
  "key": "magic_1830472847398404096_Xk3nQv8mWp2sT5yR9dL4bN6hJ1kF3gZ7xC0vQ8aE"
}
```

## Example request

```bash
curl --request POST \
  --url 'https://auth.magicdoor.com/api-keys/token' \
  --header 'Content-Type: application/json' \
  --data '{
  "key": "magic_1830472847398404096_Xk3nQv8mWp2sT5yR9dL4bN6hJ1kF3gZ7xC0vQ8aE"
}'
```

## Responses

### 200 — A new access token

- `accessToken` (string) — The token to send as `Authorization: Bearer <accessToken>` on every other request.
- `tokenType` (string) — The scheme to use in the Authorization header. Always `Bearer`. Example: `Bearer`.
- `expiresIn` (integer) — How many seconds the access token stays valid. 900, which is fifteen minutes. Exchange the key again a little early rather than waiting for a `401` and retrying. Example: `900`.

```json
{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxODI0OTAzMTE3NDQxMzM1Mjk2In0.QK1r7m",
  "tokenType": "Bearer",
  "expiresIn": 900
}
```

### 401 — The key was not accepted

```json
{
  "type": "https://httpstatuses.com/401",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid API key",
  "instance": "/api-keys/token",
  "traceId": "0HN7GK9C2M4PQ"
}
```

> **Warning: Every failure is the same 401**
>
> A malformed key, an unknown key, a revoked key, an expired key, a wrong secret, a user who has been deactivated, a user who has moved to another company, a company that has been banned, and a key left with no permissions after being narrowed to its user all return the identical response. The real reason goes to MagicDoor's logs and never to the caller, so someone probing keys learns nothing from the answer.

There is no refresh token. The API key is the durable credential, so when the access token runs out you call this endpoint again with the same key. See [Authentication](https://api-docs.magicdoor.com/authentication.md) for how keys are issued and scoped.