# Individual Token service

## POST /api-gw/oauth/individual-token-v2

Individual Token service

Authentication endpoint for **individual app** registrations. Use this flow when your app authenticates only your own Tradejini account — no browser redirect required.

Submit your account password and a 2FA value to receive an access token valid for **24 hours**.

**Prerequisite:** [Create an app](https://developer.tradejini.com/developer-portal) in the Apps Section to obtain your alphanumeric API key. Pass it as `Bearer <api_key>` in the `Authorization` header of this request.

**2FA types:**
- `otp` — One-time password sent via SMS/email. Generate it from the [CubePlus web app](https://cubeplus.tradejini.com/) under the 2FA page.
- `totp` — Time-based OTP from an authenticator app (e.g. Google Authenticator, Authy). Set up via Settings → Security → scan the QR code in the [CubePlus web app](https://cubeplus.tradejini.com/).

**Token expiry:** Tokens expire after 24 hours. An expired token returns `401 Unauthorized` — re-call this endpoint with fresh credentials.

**Rate limit:** 3 requests/second per IP.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| Authorization | header | string | Yes | Your app API key in the following format:  Bearer <api_key>  The `api_key` is the alphanumeric key from your app registration in the Apps Section. This endpoint exchanges it for an `access_token`. |

### Request Body (application/x-www-form-urlencoded)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| password | string | Yes | Enter your login password here |
| twoFa | string | Yes | To get the OTP for your client code, login into the web app [here](https://cubeplus.tradejini.com/) and in the 2FA page, click 'Having trouble with AppCode/TOTP' to see 'Send SMS / Email OTP' option to generate OTP.  For Time based OTP, login [here](https://cubeplus.tradejini.com/) and set up the Authenticator app to generate time based OTP by scanning the QR code provided under the Settings section. |
| twoFaTyp | string ("otp" | "totp") | Yes | Enter the type of TwoFactorAuthorization based on your twoFa field input. |

### Responses

#### 200 — Success response with access token

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| access_token | string | No | The access token to include in the `Authorization` header of all subsequent API requests. Format: `Bearer <api_key>:<access_token>`. |
| token_type | string | No | Token type. Always `"bearer"`. |
| expires_in | integer | No | Token lifetime in seconds. Typically `86400` (24 hours). After expiry the API returns `401 Unauthorized` — re-authenticate to get a new token. |
| scope | string | No | OAuth scope granted to the token. |

#### 400 — Bad Request — missing `password`, `twoFa`, or `twoFaTyp`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string ("Internal Error occurred. Kindly try again." | "Input validation failed. Kindly check your input contains required fields for the request") | No | Error message describing which field failed validation or why the request was rejected. |

#### 401 — Unauthorized — wrong `client_id`, password, or 2FA value. Ensure `twoFaTyp` matches the value type passed in `twoFa` (`otp` or `totp`).

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string ("Unauthorized") | No | Error message. |

#### 429 — Too Many Requests — OTP rate limit exceeded (3 req/sec per IP)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string | No | Error message indicating the rate limit was exceeded. |

#### 500 — Internal Server Error — retry with backoff

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string | No | Error message. |