Request an access token

Server URLloading...

POST

/oauth/token

Send

Authorization

Body

Exchanges an API key (client id and client secret) for a bearer token with the OAuth 2.0 client_credentials grant.

Send the credentials in one of three ways: as a JSON body, as an application/x-www-form-urlencoded body, or as an HTTP Basic Authorization header. grant_type is required in the body in every case. If you use the Basic header, either leave the credentials out of the body or send exactly the same client_id and client_secret. Otherwise the request is rejected with invalid_request.

The token is valid for one hour (expires_in is 3600). Cache it and request a new one shortly before it expires. The token does not contain the key's scopes: they are checked on every request, so revoking a key or changing its scopes takes effect immediately.

The endpoint is rate limited, per client IP address and per key. Cache your token instead of requesting a new one for every call.

Response BodyCopy Anchor Link

curl -X POST "https://example.com/oauth/token" \  -H "Content-Type: application/json" \  -d '{    "grant_type": "client_credentials",    "client_id": "tk_EXAMPLEEXAMPLEEXAMPLEEXAMPLE00",    "client_secret": "example-client-secret-not-real"  }'

{  "access_token": "eyJhbGciOi...example",  "token_type": "Bearer",  "expires_in": 3600,  "scope": "view_product",  "tenant_id": "00000000-0000-0000-0000-000000000000"}