KOkontainer
Authentication

Issue an access token from client credentials

Issues the access token every other endpoint authenticates with. One grant:

grant_type=client_credentials — exchanges the client_id and client_secret created in Settings › Client credentials (the secret is shown only once) for an access token.

No refresh token is issued. When the token expires, call this endpoint again with the same client_id and client_secret — they do not expire, and only change if you renew the secret in Settings.

The response carries expires_at, the absolute expiry as an ISO 8601 timestamp in UTC, rather than the expires_in duration RFC 6749 defines. Send the access token as Authorization: Bearer <access_token> and cache it until expires_at — this endpoint has a tighter rate limit than the rest of the API, so minting a token per request will trip it.

Once the token is past expires_at, the API answers 401 with the error code token_expired and a WWW-Authenticate: Bearer error="invalid_token" header. That code means only that: the credential is still good, so mint a new token and retry. A wrong or revoked credential answers invalid_client from this endpoint instead.

Responses use the same application/vnd.api+json content type as the rest of the API, but the request does not have to: application/vnd.api+json, application/json and form-encoded all work, so a standard OAuth2 client can use this endpoint.

Deleting or renewing a credential in Settings invalidates its tokens immediately.

post/oauth/token

Request

Request body

grant_type'client_credentials' required
client_idstring required
client_secretstring required

Example request

{
  "client_id": "4821",
  "client_secret": "sQmH1lPRWv0xJ8Yz..."
}

Response

success

token_typestring
expires_atstring date-time

Absolute expiry of the access token, ISO 8601 in UTC. Mint a new token on or before this instant.

access_tokenstring

Example response

{
  "token_type": "Bearer",
  "expires_at": "2026-08-15T09:14:45+00:00",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..."
}

Changes

No recorded changes to this operation across all 1 revision of this API.