Sign in

v1

latestOpenAPI 3.0.12026-07-135219.1 KB
Authentication

Issue an access token

Exchanges client credentials for a short-lived Bearer token used to authenticate subsequent v3 API requests.

Submit grant_type=client_credentials together with your client_id and client_secret. The response includes the access_token to send as Authorization: Bearer <token>, the token_type (always Bearer), the lifetime in seconds, and the space-delimited scope actually granted.

Scopes: omit the scope parameter to receive every scope your client is registered for, or pass a subset (space-delimited). A request for a scope outside your client's registered set returns invalid_scope.

Auth: the token endpoint itself is unauthenticated (no Bearer header). Authentication is performed by the client_id / client_secret pair you send in the body.

400 error codes (RFC 6749 §5.2):

  • invalid_client — missing or wrong client_id / client_secret.
  • unsupported_grant_type — grant_type is not client_credentials.
  • unauthorized_client — the client is not registered for the client_credentials grant.
  • invalid_scope — the requested scope exceeds the client's registered scope set.
post/oauth/token

Response

Access token issued

access_tokenstring required

Bearer token to send in Authorization: Bearer <token>. Treat it as a secret; tokens are bearer credentials.

token_type'Bearer' required

Always Bearer. Use as the auth scheme in the Authorization header.

expires_ininteger required

Seconds until the token expires (3600 = 1 hour).

scopestring required

Space-delimited list of scopes actually granted on this token. May be narrower than what you requested if some scopes are not registered on the client.

Example response

{
  "access_token": "f4a91d2bce7c4f0a9b8e3d6c5a2f1e8b9d7c6a5b4e3f2d1c0b9a8e7d6c5b4a3f",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read:schedule_files write:schedule_files"
}
All 5 operations