Get an access token

Exchanges the credentials of an API client for a bearer token using the OAuth 2.0 client credentials grant. There is no refresh token: when the access token expires, ask for another one.

Credentials go in an HTTP Basic Authorization header, built from client_id:client_secret. Create a client in the dashboard under Organization → API.

POST /oauth/token

Get an access token

cURL

curl --request POST \
  --url https://api.thingidentity.com/oauth/token \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials

200

{
  "access_token": "eyJ0eXAiOiJ0aS1hcGkrand0...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Errors

This endpoint follows RFC 6749, so every failure comes back as a flat error field rather than the envelope the other endpoints use, and a standard OAuth client can read it:

{ "error": "invalid_client" }

Status	error	Cause
400	invalid_request	grant_type is missing from both the form body and the query string.
400	unsupported_grant_type	grant_type is anything other than client_credentials.
401	invalid_client	Client authentication failed: a missing, non-Basic or malformed header, an unknown client, a wrong secret, or credentials that are blocked or deleted.
400	unauthorized_client	The organization’s subscription no longer covers API clients.
500	server_error	Our fault. Retry.

Authorizations

Authorization · string · header · required

HTTP Basic credentials of an API client: client_id:client_secret, base64 encoded.

Body

application/x-www-form-urlencoded

grant_type · enum<string> · required

The only supported grant. Also accepted as a query parameter.

Available options: client_credentials

Response

200

application/vnd.thingidentity.public.v1+json

A new access token.

access_token · string · required

The bearer token. Send it as Authorization: Bearer <access_token>.

Example:

"eyJ0eXAiOiJ0aS1hcGkrand0..."

token_type · enum<string> · required

Available options: Bearer

expires_in · integer<int64> · required

Lifetime in seconds. Read it rather than hard-coding it.

Example:

3600