---
title: "Obtain an access token via OAuth2 client credentials grant"
method: POST
path: "/auth/client-credentials"
tags: ["Auth"]
---

# Obtain an access token via OAuth2 client credentials grant

`POST /auth/client-credentials`

Performs the OAuth2 client credentials grant on behalf of a machine client, exchanging a `clientId` and `clientSecret` for an access token scoped to this service's configured Auth0 audience. Use this endpoint for automated, non-interactive service accounts and background jobs that do not act on behalf of a human user; for human user login, use `POST /auth/login` instead. No prior authentication is required to call this endpoint. Both `clientId` and `clientSecret` are required and must be non-blank — the server returns 400 if either is missing or empty; this endpoint never falls back to the service's own configured Auth0 credentials, so a caller cannot obtain a token without supplying valid credentials of their own. On success, returns a JSON object containing `accessToken`, `expiresIn` (lifetime in seconds), and `tokenType` (always `Bearer`). Pass the token as `Authorization: Bearer <accessToken>` on subsequent requests.

## Headers

- `tenant-id` string

## Request body

- ClientCredentialsRequest — Request body for client credentials authentication
  - `clientId` string, required — Auth0 client ID (required)
  - `clientSecret` string, required — Auth0 client secret (required)

## Response `200`

A JSON object containing a bearer access token (`accessToken`), its lifetime in seconds (`expiresIn`), and the token type (`tokenType`, always `Bearer`).

- ClientCredentialsResponse — Response containing access token after successful client credentials exchange
  - `accessToken` string, required — JWT access token
  - `expiresIn` integer, required — Token expiration time in seconds
  - `tokenType` string, required — Token type

## Other responses

- `400` — Returned when `clientId` or `clientSecret` is missing or blank in the request body.
- `401` — Returned when Auth0 rejects the supplied client credentials as invalid.
- `500` — Returned when the call to Auth0's token endpoint fails unexpectedly rather than a credential validation failure.

---

[API](https://skmtc.net/certifyos/apis/certify-api-layer.md) · [All operations](https://skmtc.net/certifyos/apis/certify-api-layer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/certifyos/certify-api-layer/revisions/563848e0ecc0/schema)