---
title: "Get access token"
method: POST
path: "/csc/v0/oauth2/token"
tags: ["CSC (v0)"]
---

# Get access token

`POST /csc/v0/oauth2/token`

## Request

- Base URL: `https://one.digicert.com/documentmanager`
- URL: `https://one.digicert.com/documentmanager/csc/v0/oauth2/token`
- Auth: one of:
  - API key in header `X-API-Key`
  - OAuth 2
    - Client credentials
    - Token URL: `/imauth/oauth2/token` scopes: `service`
  - OAuth 2
    - Authorization code: `/imauth/oauth2/authorize`
    - Token URL: `/imauth/oauth2/token` scopes: `service`
- TypeScript: <https://skmtc.dev/digicert/apis/digicert-content-trust-manager/docs/csc/v0/oauth2/token/post.ts> (a function with typed inputs; its response is checked against the schema)

Use this endpoint to get the access token using authentication details.

## Request body

- CscAccessTokenRequest
  - `grant_type` string, required: The grant type, which depends on the type of OAuth 2.0 flow.
  - `code` string: The authorization code returned by the authorization server. It SHALL be bound to the client identifier and the redirection URI. This SHALL be used only when grant_type is “authorization_code”.
  - `client_id` string, required: The client_id as defined in the Input parameter table in section 8.3.2.
  - `client_secret` string: This is the “client secret” previously assigned to the signature application by the remote service. It SHALL be passed if no authorization header and no client assertion is used.
  - `redirect_uri` string: The URL where the user was redirected after the authorization process completed. It is used to validate that it matches the original value previously passed to the authorization server. This SHALL be used only if the redirect_uri parameter was included in the authorization request, and their values SHALL be identical.
  - `client_data` string: Arbitrary data from the Signature Application. It can be used to handle a transaction identifier or other application-specific data.

## Response `200`

Remote service details

- CscAccessTokenResponse
  - `access_token` string: The short-lived access token to be used depending on the scope of the OAuth 2.0 authorization request. When the scope is “service” then the authorization server returns a bearer token to be used as the value of the “Authorization- Bearer” in the HTTP header of the subsequent API requests within the same session. When the scope is “credential” then the authorization server returns a Signature Activation Data token to authorize the signature request. This value SHOULD be used as the value for the SAD parameter when invoking the signatures/signHash method, as defined in section 11.9.
  - `refresh_token` string: The long-lived refresh token used to re-authenticate the user on the subsequent session based on the method described in Section 1.5 of RFC 6749 [11]. The presence of this parameter is controlled by the user and is allowed only when the scope of the OAuth 2.0 authorization request is “service”. In case grant_type is “refresh_token” the authorization server MAY issue a new refresh token, in which case the client SHALL discard the old refresh token and replace it with the new refresh token.
  - `token_type` string: When the scope is “service”, this specifies a "Bearer" token type as defined in RFC6750 [12]. When the scope is “credential”, this specifies a “SAD” token type.
  - `expires_in` integer: The lifetime in seconds of the service access token. If omitted, the default expiration time is 3600 sec. (1 hour).

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `500`: Internal Server Error

---

[API](https://skmtc.dev/digicert/apis/digicert-content-trust-manager.md) - [All operations](https://skmtc.dev/digicert/apis/digicert-content-trust-manager/llms.txt) - [OpenAPI document](https://skmtc.dev/digicert/apis/digicert-content-trust-manager/revisions/8dec322a0e2b?raw)