> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thingidentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an access token

> Exchanges the credentials of an API client for a bearer token using the OAuth 2.0 client credentials grant. There is no refresh token: when the access token expires, ask for another one.

Credentials go in an HTTP Basic `Authorization` header, built from `client_id:client_secret`. Create a client in the dashboard under **Organization → API**.

## Errors

This endpoint follows [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749), so every failure
comes back as a flat `error` field rather than the
[envelope](/api-reference/errors#the-envelope) the other endpoints use, and a standard OAuth client
can read it:

```json theme={null}
{ "error": "invalid_client" }
```

| Status | `error`                  | Cause                                                                                                                                                  |
| ------ | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `400`  | `invalid_request`        | `grant_type` is missing from both the form body and the query string.                                                                                  |
| `400`  | `unsupported_grant_type` | `grant_type` is anything other than `client_credentials`.                                                                                              |
| `401`  | `invalid_client`         | Client authentication failed: a missing, non-Basic or malformed header, an unknown client, a wrong secret, or credentials that are blocked or deleted. |
| `403`  | `unauthorized_client`    | The organization's subscription no longer covers API clients.                                                                                          |
| `500`  | `server_error`           | Our fault. Retry.                                                                                                                                      |


## OpenAPI

````yaml openapi.json POST /oauth/token
openapi: 3.1.0
info:
  title: Thing Identity Public API
  version: 1.0.0
  description: >-
    Machine-to-machine API for Thing Identity. Authenticate with client
    credentials, then call the endpoints below with the resulting bearer token.
servers:
  - url: https://api.thingidentity.com
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: Exchange client credentials for an access token.
  - name: Codes
    description: Generate GS1 barcode payloads and GS1 Digital Link URIs.
paths:
  /oauth/token:
    post:
      tags:
        - Authentication
      summary: Get an access token
      description: >-
        Exchanges the credentials of an API client for a bearer token using the
        OAuth 2.0 client credentials grant. There is no refresh token: when the
        access token expires, ask for another one.


        Credentials go in an HTTP Basic `Authorization` header, built from
        `client_id:client_secret`. Create a client in the dashboard under
        **Organization → API**.
      operationId: obtainAccessToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
              properties:
                grant_type:
                  type: string
                  enum:
                    - client_credentials
                  description: >-
                    The only supported grant. Also accepted as a query
                    parameter.
      responses:
        '200':
          description: A new access token.
          content:
            application/vnd.thingidentity.public.v1+json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: >-
            `invalid_request` when `grant_type` is missing,
            `unsupported_grant_type` when it is anything other than
            `client_credentials`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenError'
        '401':
          description: >-
            `invalid_client`. Client authentication failed: a missing, non-Basic
            or malformed header, an unknown client, a wrong secret, or
            credentials that are blocked or deleted. All of them answer alike on
            purpose.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenError'
        '403':
          description: >-
            `unauthorized_client`. The organization's subscription no longer
            covers API clients.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenError'
        '500':
          description: '`server_error`.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenError'
      security:
        - basicAuth: []
components:
  schemas:
    TokenResponse:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
          description: 'The bearer token. Send it as `Authorization: Bearer <access_token>`.'
          examples:
            - eyJ0eXAiOiJ0aS1hcGkrand0...
        token_type:
          type: string
          enum:
            - Bearer
        expires_in:
          type: integer
          format: int64
          description: Lifetime in seconds. Read it rather than hard-coding it.
          examples:
            - 3600
    TokenError:
      type: object
      required:
        - error
      description: >-
        The RFC 6749 error shape. This endpoint never uses the error envelope of
        the other endpoints.
      properties:
        error:
          type: string
          enum:
            - invalid_request
            - unsupported_grant_type
            - invalid_client
            - unauthorized_client
            - server_error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The `access_token` from `POST /oauth/token`.
    basicAuth:
      type: http
      scheme: basic
      description: >-
        HTTP Basic credentials of an API client: `client_id:client_secret`,
        base64 encoded.

````