---
id: "en/api-post-api-token-do"
title: "Get token"
language: "en"
description: "POST /api/token.do: Get the token interface description, including path, method, parameters and return information."
canonical_url: "https://www.babel.cc/public/babelwiki/en/api-post-api-token-do.html"
markdown_url: "https://www.babel.cc/public/babelwiki/ai/en/api-post-api-token-do.md"
alternates: {"en": "https://www.babel.cc/public/babelwiki/ai/en/api-post-api-token-do.md", "zh": "https://www.babel.cc/public/babelwiki/ai/zh/api-post-api-token-do.md"}
reading_note: "文档记录不等于当前部署能力；以实际版本、授权模块与配置为准。保留原文的可选、限制及待确认说明，勿补猜接口。 / Documentation is not a guarantee for every deployment. Preserve optional-module requirements, limitations and unresolved API contracts."
---

# Get Token

| Property | Value |
| --- | --- |
| Method | `POST` |
| Path | `/api/token.do` |

## Authentication Header

Use `Authorization: Basic <BASE64_CLIENT_CREDENTIALS>`, where the credentials are `Base64Encode(client_id + ":" + client_secret)`. This endpoint does not use Bearer authentication. Base64 is not encryption: use HTTPS and keep secrets on a trusted server.

## URL Parameters

The source API document specifies these as URL parameters.

| Parameter | Type | Description |
| --- | --- | --- |
| `grant_type` | string | Required; `authorization_code` |
| `code` | string | Required; authorization callback code, valid for five minutes and invalid after one use, even if the exchange fails |

The source example also includes `redirect_uri`, but its parameter table does not specify whether it is required. Keep it consistent with the authorization request and verify against the target deployment.

## Response Fields

| Field | Description |
| --- | --- |
| `access_token` | Credential for business API calls |
| `refresh_token` | Refresh credential; the source document specifies a 30-day lifetime |
| `expires_in` | Access-token lifetime in seconds; use the actual response when scheduling refreshes |

Store the latest returned credentials securely. Avoid concurrent refreshes overwriting each other; reauthorize when authentication is no longer valid. Do not expose codes or tokens in logs, monitored URLs, or screenshots. See the [API overview](https://www.babel.cc/public/babelwiki/en/developer-api-overview.html) for business-request headers; Basic authentication here does not apply to every business endpoint.