Get a machine token
POST/oauth2/token
Client credentials. Your client_id and client_secret. This is the call that gives you the machine token every other operation asks for.
Exchanges your client credentials for the access token your backend puts on every other call.
Stock OAuth2 client_credentials — point whatever library you already have at this URL; there is nothing custom to implement. Ask for the scopes your integration needs and the token comes back naming your tenant, so you never pass a tenant id to obtain it.
Cache the token for its lifetime. One token per expiry window, not one per API call. Verification is stateless, which also makes that lifetime the revocation horizon: if a client is disabled, its last token stops working when it expires and no new one is issued.
Request
Responses
- 200
- 400
- 401
Token issued.
Malformed request — an unsupported grant_type, or a scope your client does not hold.
The client id or secret is wrong, or the client has been disabled.