---
title: "OAuth 2.0 Token Endpoint"
method: POST
path: "/v1/client/token"
tags: ["Partner Token"]
---

# OAuth 2.0 Token Endpoint

`POST /v1/client/token`

Implements RFC 6749 Section 4.4.2 - Access Token Request using Client Credentials flow.

This endpoint accepts both JSON and form-urlencoded content types.

**Security considerations:**
- Uses HTTPS in production (enforced by infrastructure)
- Validates client credentials using Argon2 password hashing
- Generates cryptographically secure opaque tokens

**Grant Type:**
- Only `client_credentials` grant type is supported

**Authentication:**
- This endpoint does NOT require a bearer token
- Authentication is performed using client_id and client_secret in the request body

## Request body

- ClientAuthClientTokenBody
  - `grant_type` 'client_credentials', required — OAuth 2.0 grant type (must be "client_credentials")
  - `client_id` string, required — Client ID provided by Multiplier
  - `client_secret` string, password, required — Client secret provided by Multiplier
  - `scope` string — Optional scope (currently not supported)

## Response `200`

Token issued successfully

- ClientAuthInlineResponse200
  - `access_token` string, required — The access token to use for authenticated requests
  - `token_type` 'Bearer', required — Token type (always "Bearer")
  - `expires_in` integer, required — Token expiration time in seconds

## Other responses

- `400` — Bad Request - Validation failed
- `401` — Invalid client credentials
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/usemultiplier/apis/multiplier-public-rest-api.md) · [All operations](https://skmtc.net/usemultiplier/apis/multiplier-public-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/usemultiplier/multiplier-public-rest-api/revisions/59cd6443fdbf/schema)