---
title: "Generate a new OAuth bearer token from the given client credentials."
method: POST
path: "/oauth/bearer"
tags: ["OAuth"]
---

# Generate a new OAuth bearer token from the given client credentials.

`POST /oauth/bearer`

Application token and application secret MUST be provided, either as properties in the JSON body, or in the Authorization header.

The returned bearer token will allow the client all the same access permissions as the given application token and secret. Bearer tokens are sent in the `Authorization` header in the form `Bearer <bearer_token>`.

All bearer tokens expire one hour from generation.

## Headers

- `Authorization` string — Basic authorization header per the OAuth Client Authorization Header standard. The format is `Basic <auth_string>`, where `<auth_string>` is the base64 encoding of the string `application_token:application_secret` (the application token and application secret, separated by a colon character).

## Request body

- object
  - `application_token` string — Application token for the client. This is the application token for a particular workflow.
  - `application_secret` string — Application secret for the client. This is the application secret for a particular workflow (and must match the application token).
  - `grant_type` 'client_credentials' — OAuth grant type. Only the "Client Credentials" grant type is supported.

## Response `200`

The generated OAuth bearer token.

If credentials are sent in the Authorization header, the OAuth standard fields `access_token`, `token_type`, and `expires_in` are returned.

If credentials are sent in the JSON body, fields `bearer_token` and `expires` are returned. This is for backwards-compatibility with the original version of this API.

- object
  - `access_token` string — OAuth bearer token in JWT format.
  - `bearer_token` string — OAuth bearer token.
  - `token_type` 'bearer'
  - `expires_in` number — Seconds until expiration.
  - `expires` number — Expiration time, in **milliseconds** past the epoch.

## Other responses

- `400` — Bad Request
- `401` — Authorization failed / invalid credentials.

---

[API](https://skmtc.dev/alloy/apis/alloy-api.md) · [All operations](https://skmtc.dev/alloy/apis/alloy-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/alloy/alloy-api/revisions/405799de4d2a/schema)