---
title: "Authenticate users"
method: POST
path: "/oauth/token"
tags: ["authentication"]
---

# Authenticate users

`POST /oauth/token`

Authenticate the user before making other API calls. The token is valid for 24 hours.

## Request body

- ClientAuthRequest
  - `client_id` string, required — The unique identifier for the client. This value is provided by Coro support.
  - `client_secret` string, required — The secret for the client. This value is provided by Coro support.
  - `audience` string, required — The URL for the Coro API server
  - `grant_type` string, required — The method by which you want to request a bearer token for authentication. At this time, Coro only supports `client_credentials`.

## Response `200`

Success

- ClientAuthResponse
  - `access_token` string, required — The access token used to access API resources
  - `token_type` string, required — Bearer token.
  - `expires_in` integer, required — The expiration time of the token, in seconds. The token is valid for 24 hours.

## Other responses

- `400` — Bad request, validation error
- `401` — Unauthorized request
- `403` — Access forbidden
- `429` — Too Many Requests
- `500` — Internal server error

---

[API](https://skmtc.net/coro/apis/coro-cybersecurity-public-api.md) · [All operations](https://skmtc.net/coro/apis/coro-cybersecurity-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coro/coro-cybersecurity-public-api/revisions/b635522b2393/schema)