---
title: "Create an application access token"
method: POST
path: "/token"
tags: ["tokens"]
---

# Create an application access token

`POST /token`

Generate an application access token using OAuth 2.0 client credentials flow for server-to-server authentication. Requires client ID and secret sent via Basic authentication header with grant_type=client_credentials in the request body. Returns a bearer access token with expiration time for authenticating API requests scoped to your application. Essential for secure API access.

## Response `200`

successful operation

- object
  - `access_token` string, required — A new access token that is used to authenticate against resources that belong to the app itself.
  - `token_type` string, required — The type of token, always "Bearer"
  - `expires_in` integer, required — The lifetime of the access token, in seconds. Default is 3600.

## Other responses

- `401` — Unauthorized

## Changes

- **2025-12-03** `32790f685ab9` — 2 info
  - the endpoint scheme security `basicAuth` was added to the API
  - removed the `bearer` enum value from the `token_type` response property for the response status `200`
- **2025-06-06** `231d0268586b` — 2 breaking, 1 warning, 5 info
  - request body became required
  - request property `grant_type` was restricted to a list of enum values
  - added the new `bearer` enum value to the `token_type` response property for the response status `200`
  - the endpoint scheme security `basicAuth` was removed from the API
  - …4 more

[Change history](https://skmtc.dev/dwolla/apis/dwolla-api/changes/token/post.md)

---

[API](https://skmtc.dev/dwolla/apis/dwolla-api.md) · [All operations](https://skmtc.dev/dwolla/apis/dwolla-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dwolla/dwolla-api/revisions/0e13062ae3be/schema)