Skip to main content
POST
Obtain access token

Endpoint

Route: /oauth2/token
Content-Type: application/x-www-form-urlencoded
This endpoint does not return a refresh token. When expires_in elapses, call this endpoint again with the same client credentials.

Request body

All parameters are sent as form fields (application/x-www-form-urlencoded). client_id, client_secret, and scope are required.

Scopes

Request only the permissions you need, separated by spaces:

Example

Alternative: HTTP Basic

You may also send credentials in the Authorization header instead of the form body:
When using Basic auth, the body still requires grant_type=client_credentials and scope.

Response

200 — Token issued
Use access_token on subsequent requests:

Errors

Error responses follow the standard OAuth 2.0 format (error, error_description).

Next step

After obtaining a token, see API introduction for object routes and response format.

Body

application/x-www-form-urlencoded

Requires grant_type, client_id, client_secret, and scope as application/x-www-form-urlencoded fields.

grant_type
enum<string>
default:client_credentials
required

Must be client_credentials

Available options:
client_credentials
client_id
string
required

API client id (required)

Example:

"your-client-id"

client_secret
string<password>
required

API client secret (required)

Example:

"your-client-secret"

scope
string
default:routera-api/read routera-api/create routera-api/update routera-api/delete
required

Space-separated permissions: routera-api/read, routera-api/create, routera-api/update, routera-api/delete

Example:

"routera-api/read routera-api/create routera-api/update routera-api/delete"

Response

Access token issued

access_token
string
required

JWT access token — use as Authorization: Bearer on API routes

expires_in
integer
required

Token lifetime in seconds

token_type
enum<string>
required
Available options:
Bearer