> For the complete documentation index, see [llms.txt](https://the-wishlist-documentation.gitbook.io/the-wishlist-documentation-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-wishlist-documentation.gitbook.io/the-wishlist-documentation-docs/rest-api-reference/authentication/generate-token-original-method.md).

# Generate Token (Original method)

Generates the bearer token used to authorise every other TWC API call.

Send the request as `application/x-www-form-urlencoded`. The client id and secret are issued when your webstore is registered with TWC.

**Do not store these credentials in your front end.** Call this endpoint from your backend or integration layer — exposing the secret in the browser is a serious security risk and will also cause CORS errors.

```json
{"openapi":"3.1.0","info":{"title":"Authentication Service","version":"1.0"},"tags":[{"name":"authentication","description":"Obtain the bearer token required by every other TWC API call."}],"servers":[{"url":"https://auth.au-aws.thewishlist.io","description":""}],"security":[],"paths":{"/auth/realms/{tenantid}/protocol/openid-connect/token":{"post":{"summary":"Generate Token (Original method)","tags":["authentication"],"responses":{"200":{"description":"OK — returns the bearer token.","content":{"application/json":{"schema":{"type":"object","required":["access_token","token_type","expires_in"],"properties":{"access_token":{"type":"string","description":"The bearer token. Send it on every subsequent TWC API call as `Authorization: Bearer <access_token>`."},"token_type":{"type":"string","description":"Always `Bearer`."},"expires_in":{"type":"integer","description":"Lifetime of the access token in seconds. Configured per realm — request a new token once it elapses."},"refresh_expires_in":{"type":"integer","description":"Lifetime of the refresh token in seconds. `0` for the client-credentials grant, which issues no refresh token."},"not-before-policy":{"type":"integer","description":"Keycloak revocation policy timestamp. Not needed by API clients."},"scope":{"type":"string","description":"Space-separated scopes granted to the token."}}}}}},"401":{"description":"Invalid client credentials.","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"error_description":{"type":"string"}}}}}}},"operationId":"post-auth-realms-tenantid-protocol-openid-connect-token","description":"Generates the bearer token used to authorise every other TWC API call.\n\nSend the request as `application/x-www-form-urlencoded`. The client id and secret are issued when your webstore is registered with TWC.\n\n**Do not store these credentials in your front end.** Call this endpoint from your backend or integration layer — exposing the secret in the browser is a serious security risk and will also cause CORS errors.","parameters":[],"requestBody":{"required":true,"content":{"application/x-www-form-urlencoded":{"schema":{"type":"object","required":["grant_type","client_id","client_secret"],"properties":{"grant_type":{"type":"string","enum":["client_credentials"],"description":"Must be `client_credentials`."},"client_id":{"type":"string","description":"The client id issued to you when your webstore was registered with TWC."},"client_secret":{"type":"string","description":"The client secret issued alongside the client id. Never expose this in front-end code."}}}}}}}}}}
```