---
name: "pam_get_authtok"
section: "3"
platform: "macos"
package: "OpenPAM"
version: "35"
release: "macOS 26.5"
platforms: ["linux", "freebsd", "macos"]
url: "https://new.carta.tech/pam_get_authtok"
---

# pam\_get\_authtok(3)

retrieve authentication token

## NAME

**pam\_get\_authtok** – retrieve authentication token

## LIBRARY

library “libpam”

## SYNOPSIS

**#include \<sys/types.h\>**

**#include \<security/pam\_appl.h\>**

*int*\

**pam\_get\_authtok**(*pam\_handle\_t \*pamh*, *int item*, *const char \*\*authtok*, *const char \*prompt*);

## DESCRIPTION

The **pam\_get\_authtok** function returns the cached authentication token, or prompts the user if no token is currently cached. Either way, a pointer to the authentication token is stored in the location pointed to by the *authtok* argument.

The *item* argument must have one of the following values:

- PAM\_AUTHTOK

  Returns the current authentication token, or the new token when changing authentication tokens.

- PAM\_OLDAUTHTOK

  Returns the previous authentication token when changing authentication tokens.

The *prompt* argument specifies a prompt to use if no token is cached. If it is NULL, the PAM\_AUTHTOK\_PROMPT or PAM\_OLDAUTHTOK\_PROMPT item, as appropriate, will be used. If that item is also NULL, a hardcoded default prompt will be used.

If *item* is set to PAM\_AUTHTOK and there is a non-null PAM\_OLDAUTHTOK item, **pam\_get\_authtok** will ask the user to confirm the new token by retyping it. If there is a mismatch, **pam\_get\_authtok** will return PAM\_TRY\_AGAIN.

## RETURN VALUES

The **pam\_get\_authtok** function returns one of the following values:

- \[PAM\_BUF\_ERR\]

  Memory buffer error.

- \[PAM\_CONV\_ERR\]

  Conversation failure.

- \[PAM\_SYSTEM\_ERR\]

  System error.

- \[PAM\_TRY\_AGAIN\]

  Try again.

## SEE ALSO

[pam(3)](/pam/3.md), [pam\_get\_item(3)](/pam_get_item/3.md), [pam\_get\_user(3)](/pam_get_user/3.md), [pam\_strerror(3)](/pam_strerror/3.md)

## STANDARDS

The **pam\_get\_authtok** function is an OpenPAM extension.

## AUTHORS

The **pam\_get\_authtok** function and this manual page were developed for the FreeBSD Project by ThinkSec AS and Network Associates Laboratories, the Security Research Division of Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.