---
title: "Obtain access token"
method: POST
path: "/oauth/token"
tags: ["Authentication"]
---

# Obtain access token

`POST /oauth/token`

## Request

- Base URL: `https://auth.pirros.com`
- URL: `https://auth.pirros.com/oauth/token`
- Auth: none declared

Exchange client credentials for a Bearer token. The returned access token must be included in the Authorization header for the /v1/workspaces/* resource endpoints on the external API host. It is NOT used by the main-API-host endpoint /v1/workspaces/me, which requires a logged-in user session instead. Served by the Pirros auth host (not the external API host); the access token is a 1-hour, non-refreshable JWT for the client_credentials grant.

## Request body

- TokenRequest: OAuth 2.0 client credentials request
  - `grant_type` 'client_credentials', required
  - `client_id` string, uuid, required
  - `client_secret` string, required

## Response `200`

Access token granted

- TokenResponse: OAuth 2.0 access token response
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `request_id` string, uuid, required

## Other responses

- `400`: Invalid request (missing or invalid fields)
- `401`: Invalid client credentials
- `429`: Rate limit exceeded (5 attempts per 15 minutes per client_id + IP, error code rate_limit_exceeded, Retry-After header set; a successful token issuance resets the counter)

---

[API](https://skmtc.dev/pirros/apis/pirros-external-api.md) - [All operations](https://skmtc.dev/pirros/apis/pirros-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pirros/apis/pirros-external-api/revisions/01c66b8d9fd1?raw)