Which HTTP method should be used to obtain an authorization token (login + password)?

To obtain an authorization token using a login and password, the HTTP method POST is usually used.

This is because sensitive data (login and password) are transmitted, which should not be included in the URL (as with GET), and also because the request changes the state — the server creates a session or issues a token.

Example request:

POST /auth/token HTTP/1.1
Content-Type: application/json

{
  "username": "user",
  "password": "pass"
}

The server responds with a token, which the client will use for subsequent requests.