---
title: "OAuth 2.0 token endpoint (client_credentials grant)"
method: POST
path: "/api/oauth/token"
tags: ["OAuth"]
---

# OAuth 2.0 token endpoint (client_credentials grant)

`POST /api/oauth/token`

Exchange client credentials for a short-lived access token.

Request (``application/x-www-form-urlencoded``):
    grant_type=client_credentials&client_id=...&client_secret=...

Returns a signed JWT carrying the client's granted scopes.

## Response `200`

OK

- OAuthTokenResponse — OAuth 2.0 access token response (RFC 6749 §5.1).
  - `access_token` string, required
  - `token_type` string
  - `expires_in` integer, required
  - `scope` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/cloverhealth/apis/clover-api.md) · [All operations](https://skmtc.net/cloverhealth/apis/clover-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cloverhealth/clover-api/revisions/28797307aae6/schema)