---
title: "Issue an access token"
method: POST
path: "/oauth/token"
tags: ["Authentication"]
---

# Issue an access token

`POST /oauth/token`

Exchanges client credentials for a short-lived Bearer token used to
authenticate subsequent v3 API requests.

Submit `grant_type=client_credentials` together with your
`client_id` and `client_secret`. The response includes the
`access_token` to send as `Authorization: Bearer <token>`, the
`token_type` (always `Bearer`), the lifetime in seconds, and the
space-delimited `scope` actually granted.

**Scopes:** omit the `scope` parameter to receive every scope your
client is registered for, or pass a subset (space-delimited). A
request for a scope outside your client's registered set returns
`invalid_scope`.

**Auth:** the token endpoint itself is unauthenticated (no Bearer
header). Authentication is performed by the `client_id` /
`client_secret` pair you send in the body.

**400 error codes** (RFC 6749 §5.2):
- `invalid_client` — missing or wrong `client_id` / `client_secret`.
- `unsupported_grant_type` — `grant_type` is not `client_credentials`.
- `unauthorized_client` — the client is not registered for the
  `client_credentials` grant.
- `invalid_scope` — the requested `scope` exceeds the client's
  registered scope set.

## Response `200`

Access token issued

- object
  - `access_token` string, required — Bearer token to send in `Authorization: Bearer <token>`. Treat it as a secret; tokens are bearer credentials.
  - `token_type` 'Bearer', required — Always `Bearer`. Use as the auth scheme in the `Authorization` header.
  - `expires_in` integer, required — Seconds until the token expires (3600 = 1 hour).
  - `scope` string, required — Space-delimited list of scopes actually granted on this token. May be narrower than what you requested if some scopes are not registered on the client.

## Other responses

- `400` — Authentication or request failure (see operation description for error codes)
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/getkroo/apis/kroo-api-v3.md) · [All operations](https://skmtc.net/getkroo/apis/kroo-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getkroo/kroo-api-v3/versions/1aeb2b609ff7/schema)