External API token (client credentials)

Auth: Anonymous - no token required.

OAuth2 client-credentials grant for external API clients (OneRoster auth format).

Request

The body must be form-encoded:

• Content-Type: application/x-www-form-urlencoded (multipart/form-data is also accepted)
• grant_type=client_credentials — required; any other value returns 400 unsupported_grant_type

Supply credentials one of two ways:

⚠️ Credentials must not be placed in the query string — secrets in URLs leak through proxy/server logs, browser history and referrers. A client_id/client_secret query parameter is rejected with 400 invalid_request.

Example

curl -X POST "{baseUrl}/external/v1/token" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials"

Response

On success returns a short-lived bearer token carrying the client's configured permissions and allowed endpoints. There is no refresh token — re-request when it expires.

{
  "access_token": "<jwt>",
  "token_type": "Bearer",
  "expires_in": 3600
}

Call the API with Authorization: Bearer <access_token>.

Errors