---
title: "GET /public/auth"
method: GET
path: "/public/auth"
tags: ["Authentication", "Public"]
---

# GET /public/auth

`GET /public/auth`

Retrieve an OAuth access token, to be used for authentication of 'private' requests.

**📖 Related Article:** [Authentication](https://docs.deribit.com/articles/authentication)

**Authentication Methods:**

Three methods of authentication are supported:


- ``client_credentials`` - Using the client id and client secret that can be found on the API page on the website. This is the simplest method, suitable for server-to-server applications and quick setup.

- ``client_signature`` - Enhanced security method that uses a cryptographic signature instead of sending the client secret directly. You generate an HMAC-SHA256 signature of a string containing a timestamp, a random nonce, and optional data, using your Client Secret as the key. This method requires `` `client_id` ``, `` `timestamp` `` (current time in milliseconds), `` `nonce` ``, `` `signature` ``, and optionally a `` `data` `` field. Deribit verifies the signature instead of requiring the raw secret. Best for enhanced security, asymmetric key pairs, and avoiding secret transmission. See the [Client Signature (WebSocket) guide](https://docs.deribit.com/articles/authentication#client-signature-websocket) for detailed signature calculation instructions.

- ``refresh_token`` - Using a refresh token that was received from an earlier invocation. This allows you to obtain a new access token without re-supplying your Client ID and Client Secret. Best for long-lived sessions, token renewal, and avoiding re-authentication.


**Response:**

The response will contain an access token, expiration period (number of seconds that the token is valid) and a refresh token that can be used to get a new set of tokens.

[Try in API console](https://test.deribit.com/api_console?method=%2Fpublic%2Fauth)

## Query parameters

- `grant_type` 'client_credentials' | 'client_signature' | 'refresh_token', required
- `client_id` string, required
- `client_secret` string, required
- `refresh_token` string, required
- `timestamp` integer, required
- `signature` string, required
- `nonce` string
- `data` string
- `state` string
- `scope` string

## Response `200`

Success response

- PublicAuthResponse
  - `jsonrpc` '2.0', required — The JSON-RPC version (2.0)
  - `id` integer — The id that was sent in the request
  - `result` object, required
    - `access_token` string, required — OAuth access token to be used for authentication of 'private' requests
    - `token_type` 'bearer', required — Authorization type, allowed value - `bearer`
    - `expires_in` integer, required — Token lifetime in seconds
    - `refresh_token` string, required — Can be used to request a new token (with a new lifetime)
    - `scope` string, required — Type of the access for assigned token
    - `state` string — Copied from the input (if applicable)
    - `sid` string — Optional Session id
    - `enabled_features` string[] — List of enabled advanced on-key features.<br><br><b>Available options:</b><br>- <code>restricted_block_trades</code>: Limit the block_trade read the scope of the API key to block trades that have been made using this specific API key<br>- <code>block_trade_approval</code>: Block trades created using this API key require additional user approval. Methods that use <code>block_rfq</code> scope are not affected by Block Trade approval feature
    - `mandatory_tfa_status` string — 2FA is required for privileged methods
    - `google_login` boolean — The access token was acquired by logging in through Google.

---

[API](https://skmtc.net/deribit/apis/deribit-api.md) · [All operations](https://skmtc.net/deribit/apis/deribit-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deribit/deribit-api/revisions/78a0783dbfcc/schema)