Create an access token

Exchanges an auth token for an access token, which is what authorizes identity-scoped API calls.

Signing in returns an auth token that can only reach /identities and /access_token. Everything else (accounts, cards, transactions) needs the access token produced here.

When to call it

• After a user signs in with a password or biometrics.
• When a user with access to several identities switches between them. An access token authorizes one identity at a time, so switching means requesting another.
• When the current access token expires.

Fields

identity chooses which identity the token authorizes. If the user has access to only one, it can be omitted; otherwise list the options with List linked identities first.

clientAssertion applies only to customers enabled for delegation, and is generated from the certificate linked to the Delegated API Client.

Token status

The response carries a status of STANDARD or STEPPED_UP. Some operations (creating cards and accounts, reading a card PIN, statements) require a stepped-up token. A fresh access token is STANDARD; raise it with Send a one-time password to step up a token and Verify.