v1

latestOpenAPI 3.1.02026-07-26261466.6 KB

Authentication

Create an access token

Exchanges your client_id + client_secret for a platform access token (OAuth2 client credentials, RFC 6749 §4.4). The token lives one hour — when it expires, exchange again; there are no refresh tokens on this grant.

Get your credentials in the Agentcard dashboard under Organization → Developer → Credentials. A sandbox client mints tokens that act in sandbox; a production client acts in production.

You can also send the credentials as HTTP Basic (Authorization: Basic base64(client_id:client_secret)) instead of in the form body.

This endpoint is rate limited to 30 requests per 5 minutes per IP — cache the token and reuse it until it expires.

post/api/v2/oauth/token

Response

The token to send as Authorization: Bearer <access_token> on every other call.

access_tokenstring

The platform access token. Send it as Authorization: Bearer <access_token> on every other endpoint.

token_type'Bearer'

expires_ininteger

Seconds until the token expires (3600 = one hour).

scope'api'