---
title: "Exchange a signed client assertion for an access token"
method: POST
path: "/oauth/token"
tags: ["Token"]
---

# Exchange a signed client assertion for an access token

`POST /oauth/token`

## Request

- Base URL: `https://api.pasito.ai`
- URL: `https://api.pasito.ai/oauth/token`
- Auth: none required

OAuth2 client-credentials with `private_key_jwt` client authentication. There is no client secret: you sign a short-lived JWT assertion with the private key you downloaded when the credential was created, and receive a bearer token valid for one hour.

## Request body

- TokenRequest: An OAuth2 client-credentials token request using private_key_jwt.
  - `grant_type` string, required: Must be `client_credentials`.
  - `client_assertion_type` string: Must be `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.
  - `client_assertion` string: A JWT signed with your credential private key (RS256). `iss` and `sub` are both your credential id, `aud` is this token endpoint, and it must carry `jti`, `iat` and a short `exp`.
  - `client_id` string: Optional; if sent it must equal the assertion `sub`.
  - `client_secret` string: Not supported. Present only so the error is explicit.
  - `scope` string: Not used. Access is granted per API feature, not per scope.

## Response `200`

A successful token response.

- TokenResponse: A successful token response.
  - `access_token` string, required: A bearer token for `/v1` requests.
  - `token_type` 'Bearer', required
  - `expires_in` integer, required: Lifetime in seconds. Cache and reuse until it elapses.

## Other responses

- `400`: An RFC 6749 token-endpoint error.
- `401`: An RFC 6749 token-endpoint error.
- `429`: An RFC 6749 token-endpoint error.
- `500`: An RFC 6749 token-endpoint error.

---

[API](https://skmtc.dev/pasito/apis/pasito-external-api.md) - [All operations](https://skmtc.dev/pasito/apis/pasito-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pasito/apis/pasito-external-api/revisions/d206e98c9d61?raw)