---
title: "Create an access token"
method: POST
path: "/api/v2/oauth2/token"
tags: ["Authentication"]
---

# Create an access token

`POST /api/v2/oauth2/token`

Creates an OAuth access token using the `client_id` and `client_secret` credentials. Once generated, the token authorizes access to the 360Learning API v2 resources for 1 hour. It must be included in the `Authorization` header of each request as `Bearer`.

## Request body

- GenerateTokenBody
  - `grant_type` 'client_credentials', required — The method to request the OAuth access token. The only supported grant type is `client_credentials`.
  - `client_id` string, required — The client ID generated in the API v2 admin panel of your platform.
  - `client_secret` string, required — The client secret associated with your client ID.
  - `user_id` string, ObjectId — The unique ID of a user. This ID is mandatory for user authorized endpoints.
  - `company_id` string, ObjectId — The unique ID of a company. This ID is mandatory for service authorized endpoints.

## Response `200`

Returns an access token that must be used in all your calls to public API endpoints.

- GenerateTokenResponse
  - `token_type` 'Bearer', required — The type of the access token.
  - `access_token` string, required — The access token that authorizes access to API resources. Include the access token in the `Authorization` header of every request as `Bearer`.
  - `expires_in` number, required — The lifetime of the access token in seconds.

## Other responses

- `400` — The server cannot or will not process the request due to something that is perceived to be a client error.
- `401` — Your credentials pair `client_id`/`client_secret` is invalid.

---

[API](https://skmtc.net/360learning/apis/core-api.md) · [All operations](https://skmtc.net/360learning/apis/core-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/360learning/core-api/revisions/94b691b0b72c/schema)