---
title: "Obtain an access token"
method: POST
path: "/oauth/token"
tags: ["Authorization"]
---

# Obtain an access token

`POST /oauth/token`

## Request

- Base URL: `https://api.lwolf.com`
- URL: `https://api.lwolf.com/oauth/token`
- Auth: none required

Exchanges OAuth client credentials for a JWT access token. The returned `access_token` must be sent as a Bearer token in the `Authorization` header on all subsequent requests, together with the `lw-subscription-key` header.

**Note:** this endpoint is served from the gateway root (`https://api.lwolf.com`) rather than a service base path.

## Request body

- TokenRequest
  - `grant_type` 'client_credentials', required: OAuth 2.0 grant type. Always `client_credentials`.
  - `client_id` string, required: OAuth client identifier issued by Lone Wolf.
  - `client_secret` string, required: OAuth client secret issued by Lone Wolf.
  - `audience` string, required: Token audience. Always `https://api.lwolf.com`.
  - `lwt_client_id` string, uuid, required: Lone Wolf client (tenant) GUID.

## Response `200`

Token issued successfully.

- TokenResponse
  - `access_token` string: JWT access token to be sent as a Bearer token.
  - `token_type` string
  - `expires_in` integer: Token lifetime in seconds.

## Other responses

- `400`: The request is malformed or contains invalid parameters.
- `401`: The access token is missing, invalid, or expired.
- `403`: The caller is not permitted to perform this operation.
- `404`: The requested resource does not exist.

---

[API](https://skmtc.dev/lwolf/apis/transact-api.md) · [All operations](https://skmtc.dev/lwolf/apis/transact-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lwolf/apis/transact-api/revisions/9688b0ba3cbc?raw)