> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scute.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create M2M access token

> Create a machine-to-machine session and return long-lived JWT credentials



## OpenAPI

````yaml /swagger.json post /v1/apps/{app_id}/m2m/token
openapi: 3.0.1
info:
  title: Scute API
  version: v1
  description: API for managing users in Scute applications
servers:
  - url: https://{defaultHost}
    variables:
      defaultHost:
        default: api.scute.io
  - url: http://localhost:3333
    description: Development server
security:
  - apiSecret: []
    userAccess: []
paths:
  /v1/apps/{app_id}/m2m/token:
    parameters:
      - name: app_id
        in: path
        required: true
        description: App ID
        schema:
          type: string
    post:
      tags:
        - M2M Sessions
      summary: Create M2M access token
      description: >-
        Create a machine-to-machine session and return long-lived JWT
        credentials
      operationId: createM2mToken
      parameters: []
      responses:
        '200':
          description: successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  access:
                    type: string
                    description: JWT access token
                  access_expires_at:
                    type: string
                    format: date-time
                    description: Timestamp when the access token expires
                  refresh:
                    type: string
                    nullable: true
                    description: >-
                      Refresh token, present when the app allows refresh
                      payloads
                  refresh_expires_at:
                    type: string
                    format: date-time
                    nullable: true
                    description: Timestamp when the refresh token expires
                  csrf:
                    type: string
                    description: CSRF token required for stateful clients using cookies
                  key_id:
                    type: string
                    description: Identifier of the signing key used to mint the JWT
                  client_name:
                    type: string
                    description: Echo of the client name that owns the token
                required:
                  - access
                  - access_expires_at
                  - csrf
                  - key_id
                  - client_name
        '400':
          description: bad request - missing client name
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Client name required
                  error_code:
                    type: string
                    nullable: true
                required:
                  - error
        '403':
          description: forbidden - API key not authorized for this app
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: API key not authorized for this app
                  error_code:
                    type: string
                    nullable: true
                required:
                  - error
        '404':
          description: not found - app does not exist
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: App not found
                  error_code:
                    type: string
                    example: app_not_found
                    nullable: true
                required:
                  - error
        '500':
          description: internal server error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Failed to create M2M token
                  error_code:
                    type: string
                    nullable: true
                required:
                  - error
      security:
        - apiSecret: []
components:
  securitySchemes:
    apiSecret:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: API Secret token
    userAccess:
      type: apiKey
      name: X-Authorization
      in: header
      description: User Access token

````