Sign in
Authentication

Generate JWT token

Exchange application credentials for a scoped JWT token that allows the application to act on behalf of a specific user.

The application must be authorized for the user's email domain. The returned token expires after a configured duration and must be refreshed by calling this endpoint again.

Request parameters may be sent either as "application/x-www-form-urlencoded" (as specified by RFC 6749 for OAuth 2.0 token endpoints) or as "application/json".

post/application/token/

Request body

client_idstring required

Application client identifier

client_secretstring password required

Application secret key

grant_type'client_credentials' required

OAuth2 grant type (must be 'client_credentials')

scopestring email required

Email address of the user to delegate. The application will act on behalf of this user. Note: This parameter is named 'scope' to align with OAuth2 conventions, but accepts an email address to identify the user. This design allows for future extensibility.

Example request

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_secret": "1234567890abcdefghijklmnopqrstuvwxyz",
  "grant_type": "client_credentials",
  "scope": "user@example.com"
}

Response

Token generated successfully

access_tokenstring

JWT access token

token_typestring

Token type (always 'Bearer')

expires_ininteger

Token lifetime in seconds

scopestring

Space-separated list of granted permission scopes

Example response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWV0LWFwaSIsImF1ZCI6Im1lZXQtY2xpZW50cyIsImlhdCI6MTcwOTQ5MTIwMCwiZXhwIjoxNzA5NDk0ODAwLCJjbGllbnRfaWQiOiI1NTBlODQwMC1lMjliLTQxZDQtYTcxNi00NDY2NTU0NDAwMDAiLCJzY29wZSI6InJvb21zOmxpc3Qgcm9vbXM6cmV0cmlldmUgcm9vbXM6Y3JlYXRlIiwidXNlcl9pZCI6IjdiOGQ5YzQwLTNhMmItNGVkZi04NzFjLTJmM2Q0ZTVmNmE3YiIsImRlbGVnYXRlZCI6dHJ1ZX0.signature",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "rooms:list rooms:retrieve rooms:create"
}

Changes

Changed in 4 of the 8 revisions of this API.24