Skip to content

Get an access token

Issues a short-lived (≤ 300 s) ES256 access token (RFC 9068). Cache it and refresh 30 s before `expires_in`. Errors use RFC 6749 bodies; failed client authentication is rate-limited per (client id, source address).

POST
/oauth/token

Issues a short-lived (≤ 300 s) ES256 access token (RFC 9068). Cache it and refresh 30 s before expires_in. Errors use RFC 6749 bodies; failed client authentication is rate-limited per (client id, source address).

Authorization

clientAuth
AuthorizationBasic <token>

Client authentication at the token and revocation endpoints: private_key_jwt (client_assertion), client_secret_basic (HTTP Basic) or client_secret_post.

In: header

Request Body

application/x-www-form-urlencoded

TypeScript Definitions

Use the request body type in TypeScript.

client_credentials with private_key_jwt (client_assertion), client_secret_post, or client_secret_basic (HTTP Basic).

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'client_id=edf_test_cli_4sQn8XkP2mVb7RtY1wLcZd&client_secret=edf_test_cs_placeholder&grant_type=client_credentials&scope=events%3Awrite+events%3Avalidate'
{  "access_token": "string",  "expires_in": -9007199254740991,  "scope": "string",  "token_type": "Bearer"}

Was this page helpful?