Skip to main content
POST
Obtain access token

Endpoint

Route: /oauth2/token
Content-Type: application/x-www-form-urlencoded
This endpoint does not return a refresh token. When expires_in elapses, call this endpoint again with the same client credentials.

Request body

All parameters are sent as form fields (application/x-www-form-urlencoded). client_id and client_secret are required.

Example

Alternative: HTTP Basic

You may also send credentials in the Authorization header instead of the form body:
When using Basic auth, the body still requires grant_type=client_credentials.

Response

200 — Token issued
Use access_token on subsequent requests:

Errors

Error responses follow the standard OAuth 2.0 format (error, error_description).

Next step

After obtaining a token, see API introduction for object routes and response format.

Body

application/x-www-form-urlencoded

Requires grant_type, client_id, and client_secret as application/x-www-form-urlencoded fields.

grant_type
enum<string>
default:client_credentials
required

Must be client_credentials

Available options:
client_credentials
client_id
string
required

API client id (required)

Example:

"your-client-id"

client_secret
string<password>
required

API client secret (required)

Example:

"your-client-secret"

Response

Access token issued

access_token
string
required

JWT access token — use as Authorization: Bearer on API routes

expires_in
integer
required

Token lifetime in seconds

token_type
enum<string>
required
Available options:
Bearer