---
title: "Retrieve the access token issued by a third-party enterprise SSO provider"
method: GET
path: "/api/my-account/sso-identities/{connectorId}/access-token"
tags: ["My account"]
---

# Retrieve the access token issued by a third-party enterprise SSO provider

`GET /api/my-account/sso-identities/{connectorId}/access-token`

## Request

- Base URL: `https://[tenant_id].logto.app`
- URL: `https://[tenant_id].logto.app/api/my-account/sso-identities/{connectorId}/access-token`
- Auth: OAuth 2 (client credentials, token URL `/oidc/token`, scopes: `all`)

This API retrieves the access token issued by a third-party enterprise SSO provider for a given SSO connector ID. 
Access is only available if token storage is enabled for the corresponding connector.
When a user authenticates through a SSO provider, Logto automatically stores the provider’s tokens in an encrypted form.
You can use this API to securely retrieve the stored access token and use it to access third-party APIs on behalf of the user.

## Path parameters

- `connectorId` string, required

## Response `200`

The access token was retrieved successfully.

- object
  - `access_token` string, required
  - `scope` union
    - string
    - string[]
  - `token_type` string
  - `expires_in` union
    - number
    - string

## Other responses

- `400`: Bad Request
- `401`: Permission denied, the access_token is expired and the offline_access scope is not granted or expired.
- `403`: Forbidden
- `404`: The SSO connector does not exist or the access token is not available.

## Changes

- **2026-10-20** `1f0192b0f7ca`: 1 breaking
  - response property `scope` list-of-types was widened by adding types `array` to media type `application/json` of response `200`

[Operation history](https://skmtc.dev/logto/apis/logto-api-references/changes/api/my-account/sso-identities/:connectorId/access-token/get.md)

---

[API](https://skmtc.dev/logto/apis/logto-api-references.md) - [All operations](https://skmtc.dev/logto/apis/logto-api-references/llms.txt) - [OpenAPI document](https://skmtc.dev/logto/apis/logto-api-references/revisions/beed1405186a?raw)