What is the new/correct way to generate a URL token for tiledbasemaps and other ArcGIS services?

[AdamStewart]

You used to be able to pull your arcgis developer token directly out of your user dashboard (not API key for an app).  This allowed you to use an approx 236 char token as an URL parameter ( &f=json&token=[...]) to do stuff with ArcGIS online services such as the tile basemaps.  Since that is no longer available, I've found posts that say you can do it with a POST statement to /generatetoken?f=json  and putting the username and password as JSON in the body...

If you do that, you get either Token Required or you get "Do not put Username and password in the body" which is exactly contradictory to what the new documentation says.  Trying username or password as URL paramaters just results in a return to the login screen [which of course you can't do a login in Postman or a POST statement in a browser that I know of].

[AdamStewart · Accepted solution]

OK I misunderstood how it was described in the docs, I was sending a JSON body through Postman. 

The correct calling URL is https://www.arcgis.com/sharing/generateToken?f=json

Set the call to POST, set the type to x-www-url-encoded, then the keys option will pop up.  In there, put a param for username, password, and referer.  Referer needs to be populated so I just put in my website.  Additionally, you can add a key for the expiration to a maximum of 21600 (15 days).