---
name: "pam_get_authtok"
section: "3"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/pam_get_authtok"
---

# pam\_get\_authtok(3)

retrieve authentication token

## NAME

**pam\_get\_authtok** – retrieve authentication token

## SYNOPSIS

**#include \<sys/types.h\>**

**#include \<security/pam\_appl.h\>**

*int*\

**pam\_get\_authtok**(*pam\_handle\_t \*pamh*, *int item*, *const char \*\*authtok*, *const char \*prompt*);

## DESCRIPTION

The **pam\_get\_authtok**() function either prompts the user for an authentication token or retrieves a cached authentication token, depending on circumstances. Either way, a pointer to the authentication token is stored in the location pointed to by the *authtok* argument, and the corresponding PAM item is updated.

The *item* argument must have one of the following values:

- PAM\_AUTHTOK

  Returns the current authentication token, or the new token when changing authentication tokens.

- PAM\_OLDAUTHTOK

  Returns the previous authentication token when changing authentication tokens.

The *prompt* argument specifies a prompt to use if no token is cached. If it is NULL, the PAM\_AUTHTOK\_PROMPT or PAM\_OLDAUTHTOK\_PROMPT item, as appropriate, will be used. If that item is also NULL, a hardcoded default prompt will be used. Additionally, when **pam\_get\_authtok**() is called from a service module, the prompt may be affected by module options as described below. The prompt is then expanded using [openpam\_subst(3)](/openpam_subst/3.md) before it is passed to the conversation function.

If *item* is set to PAM\_AUTHTOK and there is a non-null PAM\_OLDAUTHTOK item, **pam\_get\_authtok**() will ask the user to confirm the new token by retyping it. If there is a mismatch, **pam\_get\_authtok**() will return PAM\_TRY\_AGAIN.

## MODULE OPTIONS

When called by a service module, **pam\_get\_authtok**() will recognize the following module options:

- authtok\_prompt

  Prompt to use when *item* is set to PAM\_AUTHTOK. This option overrides both the *prompt* argument and the PAM\_AUTHTOK\_PROMPT item.

- echo\_pass

  If the application's conversation function allows it, this lets the user see what they are typing. This should only be used for non-reusable authentication tokens.

- oldauthtok\_prompt

  Prompt to use when *item* is set to PAM\_OLDAUTHTOK. This option overrides both the *prompt* argument and the PAM\_OLDAUTHTOK\_PROMPT item.

- try\_first\_pass

  If the requested item is non-null, return it without prompting the user. Typically, the service module will verify the token, and if it does not match, clear the item before calling **pam\_get\_authtok**() a second time.

- use\_first\_pass

  Do not prompt the user at all; just return the cached value, or PAM\_AUTH\_ERR if there is none.

## RETURN VALUES

The **pam\_get\_authtok**() function returns one of the following values:

- \[PAM\_SUCCESS\]

  Success.

- \[PAM\_BAD\_CONSTANT\]

  Bad constant.

- \[PAM\_BAD\_ITEM\]

  Unrecognized or restricted item.

- \[PAM\_BUF\_ERR\]

  Memory buffer error.

- \[PAM\_CONV\_ERR\]

  Conversation failure.

- \[PAM\_SYSTEM\_ERR\]

  System error.

- \[PAM\_TRY\_AGAIN\]

  Try again.

## SEE ALSO

[openpam\_get\_option(3)](/openpam_get_option/3.md), [openpam\_subst(3)](/openpam_subst/3.md), [pam(3)](/pam/3.md), [pam\_conv(3)](/pam_conv/3.md), [pam\_get\_item(3)](/pam_get_item/3.md), [pam\_get\_user(3)](/pam_get_user/3.md), [pam\_strerror(3)](/pam_strerror/3.md)

## STANDARDS

The **pam\_get\_authtok**() function is an OpenPAM extension.

## AUTHORS

The **pam\_get\_authtok**() function and this manual page were developed for the FreeBSD Project by ThinkSec AS and Network Associates Laboratories, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.

The OpenPAM library is maintained by Dag-Erling Smørgrav ⟨*des@des.dev*⟩.