---
title: "ABDM API — Authentication"
description: "The /auth_token endpoint: how to obtain the Firebase ID token used to authenticate every other Nice HMS ABDM integration API."
date: 2026-08-26
lastModified: 2026-08-26
category: "developer"
author: "Dr. Umesh Bilagi"
beta: true
---

## `/auth_token` — POST (public, no token)

Issues the Firebase ID token used to authenticate every other endpoint. The token has an
expiration time of 15 to 30 minutes. To obtain your email and password, contact Nice HMS
directly.

### Request fields

| Name | Type | Required | Description |
|---|---|---|---|
| `email` | string | Yes | Valid email (your Nice HMS integration credential). |
| `password` | string | Yes | Non-empty password. |
| `returnSecureToken` | boolean | No | Optional; ignored in most flows. |

### Example request

```json
{
  "email": "integrator@example.com",
  "password": "your-password",
  "returnSecureToken": true
}
```

### Example response

```json
{
  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6..."
}
```

### Response shape

| Field | Type | Description |
|---|---|---|
| `token` | string | Firebase ID token. Pass as `Authorization: Bearer <token>` on all other endpoints. |

### Error codes

- `VALIDATION_ERROR` (400) — malformed body (bad email / missing password).
- `UNAUTHORIZED` (401) — invalid email or password.
- `DB_ERROR` (500) · `INTERNAL_ERROR` (500)

**Notes:** This endpoint is public (no token required) and does not check subscription.