---
title: "Authenticate"
method: POST
path: "/oauth/authorize"
tags: ["Authentication"]
---

# Authenticate

`POST /oauth/authorize`

## Request

- Base URL: `https://api.soldo.com`
- URL: `https://api.soldo.com/oauth/authorize`
- Auth: none declared
- TypeScript: <https://skmtc.dev/soldo/apis/soldo-business-api-v2-0/docs/oauth/authorize/post.ts> (a function with typed inputs; its response is checked against the schema)

Grant access to the API getting an `OAuth2Token`.

## Request body `application/x-www-form-urlencoded`

- object
  - `client_id` string, required: The client ID issued while [Setting up the API](doc:api-set-up), this works as a username.
  - `client_secret` string, required: The client secret issued while [Setting up the API](doc:api-set-up), this works as a password.

## Response `200`

The `OAuth2Token`.

- OAuth2Token
  - `refresh_token` string: The token used to refresh the session (this operation is not currently supported).
  - `token_type` string: All requests must be always authenticated using the 'Bearer' scheme.
  - `access_token` string: The bearer token to be included in all requests sent to our Business API as part of the `Authorization` header.
  - `expires_in` string: The `access_token` expiration, expressed in seconds. Once the `access_token` is expired your session will be invalidate, you will have to re-authenticate to get a fresh `access_token`.

## Other responses

- `400`: Your request has missing arguments or is malformed.
- `403`: The access token you are using is not granted with the necessary permissions or is expired. Check client scopes and fingerprint requirements.

---

[API](https://skmtc.dev/soldo/apis/soldo-business-api-v2-0.md) - [All operations](https://skmtc.dev/soldo/apis/soldo-business-api-v2-0/llms.txt) - [OpenAPI document](https://skmtc.dev/soldo/apis/soldo-business-api-v2-0/revisions/9fa34523c5a0?raw)