> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange client credentials for an access token.

> OAuth 2.0 client_credentials grant. Send form-urlencoded grant_type=client_credentials, client_id and client_secret. Returns a bearer access token for the Secfix Public API audience.



## OpenAPI

````yaml /api-reference/openapi.yaml post /oauth/token
openapi: 3.0.1
info:
  title: Secfix Public API
  description: >-
    Machine-to-machine API for the Secfix compliance platform. Authenticate with
    the OAuth 2.0 client_credentials grant via POST /oauth/token, then call /v1
    endpoints with the bearer access token. Errors follow RFC 7807
    (application/problem+json) with stable code strings; lists use opaque cursor
    pagination.
  contact:
    name: Secfix Support
    url: https://secfix.com
    email: support@secfix.com
  license:
    name: Proprietary
    url: https://secfix.com/license
  version: 1.0.0
servers:
  - url: https://api.secfix.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Health
    description: Service liveness.
  - name: Inventory
    description: List and govern assets across all categories.
  - name: OAuth
    description: Token endpoint for OAuth 2.0 client-credentials authentication.
  - name: Computers
    description: Read-only monitored computers with device compliance posture.
paths:
  /oauth/token:
    post:
      tags:
        - OAuth
      summary: Exchange client credentials for an access token.
      description: >-
        OAuth 2.0 client_credentials grant. Send form-urlencoded
        grant_type=client_credentials, client_id and client_secret. Returns a
        bearer access token for the Secfix Public API audience.
      operationId: token
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
components:
  schemas:
    OAuthTokenRequest:
      required:
        - client_id
        - client_secret
        - grant_type
      type: object
      properties:
        audience:
          type: string
          description: >-
            Target API audience. Optional - omit it and the Secfix Public API
            audience is used. Supplying any other value is rejected with 400
            unsupported_audience.
        client_id:
          type: string
          description: The application's client id.
          example: aB3xY7...
        client_secret:
          type: string
          description: The application's client secret.
          example: s3cr3t...
        grant_type:
          type: string
          description: OAuth 2.0 grant type.
          example: client_credentials
          enum:
            - client_credentials
      description: OAuth 2.0 client-credentials token request (form-urlencoded).
    AccessTokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: The signed RS256 bearer access token.
          example: eyJhbGciOiJSUzI1NiIsImtpZCI6...
        expires_in:
          type: integer
          description: Token lifetime in seconds.
          format: int64
          example: 86400
        token_type:
          type: string
          description: Always "Bearer".
          example: Bearer
      description: OAuth 2.0 client-credentials token response.
  securitySchemes:
    bearerAuth:
      type: http
      description: Bearer access token obtained from /oauth/token.
      scheme: bearer
      bearerFormat: JWT

````