---
title: "Obtain OAuth2 Token (client_credentials)"
method: POST
path: "/auth/realms/ema-fhir/protocol/openid-connect/token"
tags: ["Authentication"]
---

# Obtain OAuth2 Token (client_credentials)

`POST /auth/realms/ema-fhir/protocol/openid-connect/token`

## Request

- Base URL: `https://ssoqa01-lb-01.m2qa.com`
- URL: `https://ssoqa01-lb-01.m2qa.com/auth/realms/ema-fhir/protocol/openid-connect/token`
- Auth: API key in header `x-api-key`

Obtain an access token using the OAuth2 `client_credentials` grant. Send your `client_id` and `client_secret`. Returns an RS256-signed JWT; the `scope` claim is a space-separated list of ACLs and no refresh token is returned.

**Requires the `x-api-key` header on this request itself**, not just on the downstream FHIR calls that follow. Omitting it still returns a 200 with a valid-looking token, but every downstream FHIR call then fails. This is the `x-api-key` provisioned for your client_credentials vendor application — a different value than the one used with the legacy `password` grant.

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` string, required
  - `client_id` string, required: Your vendor application's client_id
  - `client_secret` string, required: Your vendor application's client_secret

## Response `200`

Access token response

- object
  - `access_token` string: RS256-signed JWT
  - `expires_in` integer
  - `refresh_expires_in` integer
  - `token_type` string
  - `not-before-policy` integer
  - `scope` string: Space-separated list of ACL scopes

---

[API](https://skmtc.dev/modmed/apis/ema-proprietary-api-authentication.md) - [All operations](https://skmtc.dev/modmed/apis/ema-proprietary-api-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/modmed/apis/ema-proprietary-api-authentication/revisions/c5cf2dc39042?raw)