---
title: "Obtain access token"
method: POST
path: "/v1/auth/token"
tags: ["Authentication"]
---

# Obtain access token

`POST /v1/auth/token`

## Request

- Base URL: `https://api.oway.io`
- URL: `https://api.oway.io/v1/auth/token`
- Auth: none declared

Exchange client credentials for an access token.

The returned token includes scopes that determine API access:
- `shipper` scope grants access to `/v1/shipper/**` endpoints
- `carrier` scope grants access to `/v1/carrier/**` endpoints
- Partners with both scopes can access both APIs with a single token

The returned token should be included in subsequent API requests as a Bearer token
in the authorization header: `authorization: Bearer {access_token}`

Tokens are valid for the duration specified in `expires_in` (seconds).
We recommend caching tokens and refreshing them before expiration.

## Request body

- TokenRequest: Token request containing client credentials
  - `clientId` string, required: Client ID provided by Oway
  - `clientSecret` string, required: Client secret provided by Oway

## Response `200`

Token successfully generated

- TokenResponse: Successful token response
  - `accessToken` string: The access token to use for API requests
  - `tokenType` string: Token type (always 'Bearer')
  - `expiresIn` integer: Token validity in seconds

## Other responses

- `400`: Invalid request: missing required fields
- `401`: Unauthorized: invalid credentials

---

[API](https://skmtc.dev/shipoway/apis/oway-auth-api.md) - [All operations](https://skmtc.dev/shipoway/apis/oway-auth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shipoway/apis/oway-auth-api/revisions/0a972947c133?raw)