Authentication
v1
stable
Exchange service-account credentials
Exchange an active service account's client credentials for a short-lived bearer token. No refresh token is issued.
POST
/api/v1/oauth/token
Access and behavior
- Required scope
- none (the resulting token carries the service account's scopes)
- Authentication
- OAuth2 client credentials
- Idempotency
- not-applicable
- Operation ID
- exchangeServiceAccountToken
Request headers
| Header | Presence | Description |
|---|---|---|
| Content-Type | Required | Request document media type. |
Request body
application/json
Schema: TokenRequest
· Required
client_id
Required
string
Request field.
client_secret
Required
string
Request field.
grant_type
Required
enum: client_credentials
Request field.
request.json
{
"client_id": "cid_example",
"client_secret": "<client-secret>",
"grant_type": "client_credentials"
}Success response
200
A short-lived bearer token.
- Media type
- application/json
- Schema
- TokenResponse
Errors and retries
Keep x-request-id
from failed responses. Retry only rows marked retryable, and obey
Retry-After
when present.
| Status | Code | Recovery | Meaning |
|---|---|---|---|
| 400 | unsupported_grant_type | Do not retry unchanged | grant_type must be client_credentials. |
| 401 | invalid_client | Do not retry unchanged | The credentials are missing, inactive, revoked, or invalid. |
| 429 | rate_limited | Retry after guidance | The request exceeded its rate window; wait for Retry-After. |
Related guides
Make your first API request
Create read-only service-account access, exchange it for a short-lived token, and verify a bounded workflow-list response.
Exchange service-account credentials
Call the client-credentials token endpoint safely, interpret its response, and cache short-lived bearer tokens without a refresh token.