---
title: "Secure embed view"
method: POST
path: "/oauth/embed-token"
tags: ["Authentication"]
---

# Secure embed view

`POST /oauth/embed-token`

## Request

- Base URL: `https://v3.api.hypertrack.com`
- URL: `https://v3.api.hypertrack.com/oauth/embed-token`
- Auth: none declared
- TypeScript: <https://skmtc.dev/hypertrack/apis/hypertrack-api/docs/oauth/embed-token/post.ts> (a function with typed inputs; its response is checked against the schema)

Exchange an order detail view URL for a short-lived secure URL with an endpoint-restricted access token appended. The order must exist and have an associated device. This endpoint is not a general-purpose exchange for arbitrary dashboard or list-view URLs. Authenticate with HTTP Basic auth using your account ID and secret key. Use the returned `secure_embed_url` as the iframe source without changing its query parameters.

## Request body

- object
  - `embed_url` string, required: Order detail URL with a path containing `/orders/{order_handle}`. The `fulfillment_attempt` query parameter defaults to 0. Use `show-visits-only=true` for visit-only visibility.
  - `grant_type` 'client_credentials', required: Must be `client_credentials`.

## Response `200`

Secure embed URL issued.

- object
  - `access_token` string: Endpoint-restricted OAuth access token for the order view.
  - `token_type` string
  - `expires_in` integer: Token lifetime in seconds.
  - `embed_url` string: Original URL to be embedded.
  - `secure_embed_url` string: Secure URL with the token appended for embedding.

## Other responses

- `400`: Invalid parameters (missing `embed_url` or invalid `grant_type`).
- `401`: Authentication failed.
- `404`: Order or device not found.

---

[API](https://skmtc.dev/hypertrack/apis/hypertrack-api.md) - [All operations](https://skmtc.dev/hypertrack/apis/hypertrack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hypertrack/apis/hypertrack-api/revisions/389326c4c9c8?raw)