Skip to main content
POST
Exchange client credentials for an access token.

Authorizations

Authorization
string
header
required

Bearer access token obtained from /oauth/token.

Body

application/x-www-form-urlencoded

OAuth 2.0 client-credentials token request (form-urlencoded).

client_id
string
required

The application's client id.

Example:

"aB3xY7..."

client_secret
string
required

The application's client secret.

Example:

"s3cr3t..."

grant_type
enum<string>
required

OAuth 2.0 grant type.

Available options:
client_credentials
Example:

"client_credentials"

audience
string

Target API audience. Optional - omit it and the Secfix Public API audience is used. Supplying any other value is rejected with 400 unsupported_audience.

Response

200 - application/json

OK

OAuth 2.0 client-credentials token response.

access_token
string

The signed RS256 bearer access token.

Example:

"eyJhbGciOiJSUzI1NiIsImtpZCI6..."

expires_in
integer<int64>

Token lifetime in seconds.

Example:

86400

token_type
string

Always "Bearer".

Example:

"Bearer"