---
title: "Client Credentials Exchange"
method: POST
path: "/auth/client-credentials"
tags: ["Auth"]
---

# Client Credentials Exchange

`POST /auth/client-credentials`

Performs OAuth2 client credentials grant flow and returns an access token. Uses configured audience.

## Headers

- `tenant-id` string

## Request body

- ClientCredentialsRequest — Request body for client credentials authentication
  - `clientId` string — Auth0 client ID. If not provided, uses configured client ID
  - `clientSecret` string — Auth0 client secret. If not provided, uses configured client secret

## Response `200`

Authentication successful

- ClientCredentialsResponse — Response containing access token after successful client credentials exchange
  - `accessToken` string, required — JWT access token
  - `expiresIn` integer, required — Token expiration time in seconds
  - `tokenType` string, required — Token type

## Other responses

- `400` — Bad request - Invalid parameters
- `401` — Authentication failed - Invalid client credentials
- `500` — Internal server error

---

[API](https://skmtc.net/certifyos/apis/certify-api-layer.md) · [All operations](https://skmtc.net/certifyos/apis/certify-api-layer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/certifyos/certify-api-layer/revisions/3d27e9019c7b/schema)