---
title: "POST /service-account-token"
method: POST
path: "/service-account-token"
tags: ["Service Accounts"]
---

# POST /service-account-token

`POST /service-account-token`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/service-account-token`
- Auth: none required

Exchange service account credentials for an organization-scoped M2M token.

Credentials may be provided via HTTP Basic Authentication (RFC 6749 Section 2.3.1,
preferred) or as form body parameters. The server MUST NOT accept credentials in
both locations simultaneously and will reject such requests with a 400 error.

## Headers

- `X-Client-Request-ID` string, uuid

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'client_credentials', required: OAuth 2.0 grant type (must be "client_credentials")
  - `client_id` string, nullable: Service account client ID. Required if not using HTTP Basic Authentication.
  - `client_secret` string, nullable: Service account client secret. Required if not using HTTP Basic Authentication.

## Response `200`

M2M token generated successfully

- OrgManagementTokenResponse: OAuth2-style token response for M2M tokens
  - `access_token` string, required: The M2M access token
  - `token_type` string, required: Token type (always "Bearer")
  - `expires_in` integer: Token expiration time in seconds

## Other responses

- `400`: bad request error response when caller supplied invalid input data
- `401`: unauthorized error response when caller session is not authenticated
- `404`: not found error response when caller does not have permission to see a resource or the resource does not exist
- `429`: rate limit exceeded error response when caller has exhausted api limits for the given time period
- `500`: internal server error response when server encountered error of its own creation
- `503`: service unavailable error when server you're attempting to reach is not available
- `default`: internal server error response when server encountered error of its own creation

## Changes

- **2026-10-16** `0cfaff865771`: 14 breaking, 7 warning, 72 info
  - the response property `details/items/field` became optional for the status `400`
  - the response property `details/items/field` became optional for the status `401`
  - the response property `details/items/field` became optional for the status `404`
  - the response property `details/items/field` became optional for the status `429`
  - …89 more
- **2026-03-16** `d3d69f45bfed`: 4 info
  - the request property `client_id` became nullable
  - the request property `client_secret` became nullable
  - the request property `client_id` became optional
  - the request property `client_secret` became optional
- **2026-02-06** `edd1b760a989`: 1 warning
  - deleted the `header` request parameter `X-Request-ID`

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/service-account-token/post.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)