---
title: "Request v3 Access Token"
method: POST
path: "/authenticationservices/v3/oauth/token"
tags: ["Authentication v3"]
---

# Request v3 Access Token

`POST /authenticationservices/v3/oauth/token`

## Request

- Base URL: `https://tts.sandbox.apib2b.citi.com/citiconnect/sb`
- URL: `https://tts.sandbox.apib2b.citi.com/citiconnect/sb/authenticationservices/v3/oauth/token`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/citi/apis/authentication-services/docs/authenticationservices/v3/oauth/token/post.ts> (a function with typed inputs; its response is checked against the schema)

The OAuth v3 token request authenticates your API message sent in either JSON or XML formats and responds with an access token.

## Headers

- `Content-Type` string, required
- `Authorization` string, required

## Request body

- Request
  - `oAuthToken` OAuthTokenType: The response body for the V2 authentication service to retrieve an OAuth token.
    - `grantType` string, required: You must always pass 'client_credentials' in this field because Citi only provides credentials-based authentication for API users.
    - `scope` string, required: This is the version scope of the authentication call. Note that this value will be the same for ALL versions of the Authentication API and should be `/authenticationservices/v1` (even for versions 2, 3, and 4).

## Response `200`

OK

- Token: The response body for the V2 authentication service to retrieve an OAuth token.
  - `token_type` string: The default value will be “Bearer”.
  - `access_token` string: Contains the OAuth Token that will be used for authenticating successive API calls.
  - `expires_in` string: The expiry time limit of the OAuth Token in seconds.
  - `scope` string: The version scope of the authentication call. The value will be the same for all the API versions.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found
- `405`: Method Not Allowed
- `415`: Unsupported Media Type
- `500`: Internal Server Error

## Changes

- **2026-11-06** `32b7b9eec629`: 14 breaking, 14 warning, 23 info
  - the response's body type changed from `object` to no type for status `200` (media type: application/json)
  - the response's body type changed from `object` to no type for status `200` (media type: application/xml)
  - removed the required property `httpCode` from the response with the `400` status (media type: application/json)
  - removed the required property `httpCode` from the response with the `400` status (media type: application/xml)
  - …47 more

[Operation history](https://skmtc.dev/citi/apis/authentication-services/changes/authenticationservices/v3/oauth/token/post.md)

---

[API](https://skmtc.dev/citi/apis/authentication-services.md) - [All operations](https://skmtc.dev/citi/apis/authentication-services/llms.txt) - [OpenAPI document](https://skmtc.dev/citi/apis/authentication-services/revisions/32b7b9eec629?raw)