Issue an access token

Server URLloading...

POST

/api/v1/oauth/token

Send

Authorization

Body

OAuth 2.0 client-credentials token endpoint. Exchanges the API key you are already calling with for a bearer token that authenticates as the same account — use it to sign that account into the dashboard, or to call any endpoint that expects Authorization: Bearer instead of an API key.

Your API key is the client credential, so there is nothing to send: the account is whichever one the X-API-Key header resolves to. An agent-scoped API key returns a token for the account that owns the agent.

The body is optional. If you send one — as JSON or as application/x-www-form-urlencoded, both are accepted — grant_type must be client_credentials; any other value returns 400. There is no authorization-code flow: this endpoint never issues a token for an account other than the caller's.

expires_in is always null: the token does not expire, and no refresh_token is issued because there is nothing to refresh. Treat it as a long-lived credential and store it like a password. The only way to invalidate it is to block or deactivate the account.

Because the token carries exactly the authority the API key already had, any active account can call this — there is no extra permission to hold.

Response Body

curl -X POST "https://loading/api/v1/oauth/token" \  -H "Content-Type: application/json" \  -d '{    "grant_type": "client_credentials"  }'

{
  "success": true,
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "Bearer",
    "expires_in": null,
    "user_id": "ckv9x8y7z6w5v4u3t2s1r0q9"
  }
}

{
  "success": false,
  "message": "unsupported_grant_type: only client_credentials is supported"
}

{
  "success": false,
  "message": "user not authenticated"
}

{
  "success": false,
  "message": "account is blocked or inactive"
}

{
  "success": false,
  "message": "internal server error"
}