> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Obtain and use an OAuth 2.0 access token.

The Secfix Public API uses the OAuth 2.0 **client-credentials** grant. Exchange your application's
client id and secret for a short-lived bearer access token, then send that token on every request.

## Get a token

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://api.secfix.com/oauth/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=client_credentials" \
    -d "client_id=YOUR_CLIENT_ID" \
    -d "client_secret=YOUR_CLIENT_SECRET"
  ```
</CodeGroup>

```json Response theme={null}
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 86400
}
```

The `audience` parameter is optional and defaults to the Secfix Public API; any other value is
rejected.

## Call the API

Send the access token as a bearer token:

```bash theme={null}
curl https://api.secfix.com/v1/inventory/assets \
  -H "Authorization: Bearer eyJhbGciOi..."
```

## Single active token

Each application has **one active token at a time**. Requesting a new token (or rotating the
secret) immediately supersedes the previous token — the old token stops working and returns
`401 token_superseded`. Design your integration to fetch a token, reuse it until it expires, and
re-fetch on `401`.

## Tenancy

Your workspace is bound to the token at issuance from the token's `customer_id` claim. The API
ignores any client-supplied tenant hints — you only ever see your own workspace's data.