---
title: "Authenticated shopper token (Client Hosted Shopper)"
method: POST
path: "/oauth20/token (Client Hosted Shopper)"
tags: ["Token"]
---

# Authenticated shopper token (Client Hosted Shopper)

`POST /oauth20/token (Client Hosted Shopper)`

Use this Client Credentials Grant OAuth flow when the Digital River partner maintains the shopper login and password credentials. <br> <br> Request a full access token for the authenticated shopper by providing the shopper's external reference identifier and the client_credentials enum as the grant type. <br> <br> Security requires HTTP basic authentication (base-64 encoded), a user API key, and a password (secret key). <br> <br> <b>Important</b>&colon; Never expose or visibly display the Limited or Full Access Tokens requested by the APIs to the customer (such as plain text in a cookie). Suppose a customer has access to these tokens. They could bypass any restrictions built into the store frontend and place orders directly on our systems via publicly documented APIs.

## Response `200`

Successful response.

- ClientCredentialToken
  - `access_token` string
  - `token_type` string
  - `expires_in` string

## Other responses

- `400` — * dr_limited_token_invalid * invalid_request
- `401` — * invalid_client * invalid_request

---

[API](https://skmtc.net/digitalriver/apis/commerce-api-suite-shopper-apis.md) · [All operations](https://skmtc.net/digitalriver/apis/commerce-api-suite-shopper-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/digitalriver/commerce-api-suite-shopper-apis/revisions/4b69392f93b9/schema)