---
title: "Create an access token"
method: POST
path: "/api/v2/oauth/token"
tags: ["Authentication"]
---

# Create an access token

`POST /api/v2/oauth/token`

Exchanges your `client_id` + `client_secret` for a platform access token (OAuth2 client credentials, RFC 6749 §4.4). The token lives one hour — when it expires, exchange again; there are no refresh tokens on this grant.

Get your credentials in the Agentcard dashboard under **Organization → Developer → Credentials**. A sandbox client mints tokens that act in sandbox; a production client acts in production.

You can also send the credentials as HTTP Basic (`Authorization: Basic base64(client_id:client_secret)`) instead of in the form body.

This endpoint is rate limited to 30 requests per 5 minutes per IP — cache the token and reuse it until it expires.

## Response `200`

The token to send as `Authorization: Bearer <access_token>` on every other call.

- TokenResponse
  - `access_token` string — The platform access token. Send it as `Authorization: Bearer <access_token>` on every other endpoint.
  - `token_type` 'Bearer'
  - `expires_in` integer — Seconds until the token expires (3600 = one hour).
  - `scope` 'api'

## Other responses

- `400` — `unsupported_grant_type` — the `grant_type` isn't `client_credentials`. `unauthorized_client` — the client can't use this grant.
- `401` — `invalid_client` — unknown client or bad credentials.
- `403` — `access_denied` — the organization is suspended.

---

[API](https://skmtc.dev/agentcard/apis/agentcard-api.md) · [All operations](https://skmtc.dev/agentcard/apis/agentcard-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentcard/agentcard-api/revisions/638d12c8303f/schema)