> For the complete documentation index, see [llms.txt](https://sway-technologies.gitbook.io/sway-charts-api-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sway-technologies.gitbook.io/sway-charts-api-documentation/rest-api-specification/authentication-and-authorization/post-create-session-token.md).

# POST Create Session Token

```
POST https://api.swaycharts.io/dxsca-web/login
```

Creates a Basic Authentication session token that should be used in all further requests

* User `POSTs` their username, domain and password
* Server generates a random access token which is returned to the client
* Client receives the token and uses it in all further requests supplying it in a header
* Token expires due to:
  * Client `POSTs` a request to a special "logout" resource (see [Logout](/sway-charts-api-documentation/rest-api-specification/authentication-and-authorization/post-logout.md))
  * Client is forced to log out by the platform operations team
  * Client is revoked the permission to use the REST API
  * A pre-configured timeout passes since last request from the client
* Upon a request with an expired token, client receives the `401 Unauthorized` error and is expected to repeat the authentication procedure.

To avoid situations with sudden disconnects due to inactivity, client is expected to track token expiration on its side and either renew the session or use the [Ping API](/sway-charts-api-documentation/rest-api-specification/authentication-and-authorization/post-ping.md) to maintain the session.

```json
// Request JSON

{
    "username": "username of the client",
    "domain": "domain of the client",
    "password": "password of the client"
}
```

[Common errors](https://api.swaycharts.io/developers/#/DXtrade-REST-API?id=errors)

**Authentication failed due to username/password mismatch**

* Status code: `401 Unauthorized`
* Error code: `3`
* Description: `Incorrect username or password`