> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# Issue a JWT

API documentation for the FusionAuth Issue a JWT API.

# Issue a JWT

This API is used to issue a new access token (JWT) using an existing access token (JWT).

This API provides the single sign-on mechanism for access tokens. For example you have an access token for application A and you need an access token for application B. You may use this API to request an access token to application B with the authorized token to application A. The returned access token will have the same expiration of the one provided.

This API will use a JWT as authentication. See [JWT Authentication](https://fusionauth.io/docs/apis/authentication.md#jwt-authentication) for examples of how you can send the JWT to FusionAuth.

## Request

[!JWT Authentication](https://fusionauth.io/docs/apis/authentication.md#jwt-authentication)

Issue a JWT

GET/api/jwt/issue?applicationId={applicationId}&refreshToken={refreshToken}

OpenAPI Spec

### Request Parameters

`applicationId`UUIDrequired

The Id of the application for which authorization is being requested.

`refreshToken`Stringoptional

An existing refresh token used to request a refresh token in addition to a JWT in the response. If the cookie `refresh_token` is also on the request it will take precedence over this value.

The target application represented by the **applicationId** request parameter must have refresh tokens enabled in order to receive a refresh token in the response.

#### Request Headers

`X-FusionAuth-TenantId`Stringoptional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See [Making an API request using a Tenant Id](https://fusionauth.io/docs/apis/authentication.md#making-an-api-request-using-a-tenant-id) for additional information.

### Request Cookies

`refresh_token`Stringoptional

The refresh token to be used to exchange for a refresh token in the application represented by the **applicationId** request parameter.

Example HTTP Request using cookie

```shell
GET /api/jwt/issue HTTP/1.1
Cookie: refresh_token=xRxGGEpVawiUak6He367W3oeOfh+3irw+1G1h1jc
```

## Response

*Response Codes*

| Code | Description |
| --- | --- |
| 200 | The request was successful. The response will contain a JSON body. |
| 202 | The request was successful. The response will contain a JSON body. The user is not authorized to the requested application, the returned access token will not contain claims for an application. This user is authenticated but not registered. |
| 401 | You did not supply a valid Authorization header, the header was omitted or your access token is expired. The response will be empty. See \[Authentication\](https://fusionauth.io/docs/apis/authentication.md). |
| 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. |
| 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. |

### Response Body

`token`String

The encoded access token.

`refreshToken`String

The refresh token. This value will only be returned if a valid non-expired refresh token was provided on the request and **application.loginConfiguration.generateRefreshTokens** is `true`. The returned refresh token will share the same creation time as the original refresh token in regards to how the token expiration is calculated.

The refresh token expiration policy as defined by **jwtConfiguration.refreshTokenExpirationPolicy** must be the same as the source application, if the policies are different a refresh token will not be returned.

*Example Response JSON*

```json
{
"token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE0ODc5NzU0NTgsImlhdCI6MTQ4Nzk3MTg1OCwiaXNzIjoiYWNtZS5jb20iLCJzdWIiOiI4NThhNGIwMS02MmM4LTRjMmYtYmZhNy02ZDAxODgzM2JlYTciLCJhcHBsaWNhdGlvbklkIjoiM2MyMTllNTgtZWQwZS00YjE4LWFkNDgtZjRmOTI3OTNhZTMyIiwicm9sZXMiOlsiYWRtaW4iXX0.O29_m_NDa8Cj7kcpV7zw5BfFmVGsK1n3EolCj5u1M9hZ09EnkaOl5n68OLsIcpCrX0Ue58qsabag3MCNS6H4ldt6kMnH6k4bVg4TvIjoR8WE-yGcu_xDUObYKZYaHWiNeuDL1EuQQI_8HajQLND-c9juy5ILuz6Fhx8CLfHCziEHX_aQPt7jQ2IIasVzprKkgvWS07Hiv2Oskryx49wqCesl46b-30c6nfttHUDEQrVq9gaepca3Nhjj_cPtC400JgLCN9DOYIbtd69zvD8vDUOvVzMr2HGdWtKthqa35NF-3xMZKD8CShe8ZT74fNd9YZ0WRE-YeIf3T_Hv5p5V2w",
"refreshToken": "YRjxLpsjRqL7zYuKstXogqioA_P3Z4fiEuga0NCVRcDSc8cy_9msxg"
}
```