---
title: "Issue an OAuth access token"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Issue an OAuth access token

`POST /oauth/token`

## Request

- Base URL: `https://api.zenzap.co`
- URL: `https://api.zenzap.co/oauth/token`
- Auth: none required
- TypeScript: <https://skmtc.dev/zenzap/apis/zenzap-external-integration-api/docs/oauth/token/post.ts> (a function with typed inputs; its response is checked against the schema)

Exchanges OAuth client credentials for a short-lived bearer access token.

Only the **`client_credentials`** grant is supported on this endpoint. Use the `clientId` and `clientSecret` returned when the bot was created (or rotated) in your Zenzap admin console.

**Client authentication**: either send `client_id` + `client_secret` in the form body, or use HTTP Basic Auth with the same values (`Authorization: Basic base64(clientId:clientSecret)`).

**Scopes**: omit the `scope` field to receive a token with all scopes configured on the bot, or pass a space-separated subset to down-scope. Requesting a scope that the bot was not granted at creation will fail.

**Token lifetime**: 1 hour. There is **no refresh token** — re-mint with the client credentials when the token expires.

Tokens are JWTs bound to the issuing region and to the bot. They are validated on every request. See [Authentication](/api-reference/authentication) for the full reference.

## Request body `application/x-www-form-urlencoded`

- OAuthTokenRequest
  - `grant_type` 'client_credentials', required: OAuth 2.0 grant type. Only `client_credentials` is supported.
  - `client_id` string: The bot's OAuth `clientId` (returned when the bot was created or rotated). Omit if you authenticate via HTTP Basic Auth.
  - `client_secret` string: The bot's OAuth `clientSecret`. Omit if you authenticate via HTTP Basic Auth.
  - `scope` string: Space-separated list of OAuth scopes to request. Optional — if omitted, the issued token receives every scope the bot was granted at creation. Passing a scope the bot was not granted will fail with `invalid_grant`.

## Response `200`

Access token issued

- OAuthTokenResponse
  - `access_token` string, required: JWT bearer token. Pass as `Authorization: Bearer <access_token>` on every API request.
  - `token_type` 'Bearer', required: Always `Bearer`.
  - `expires_in` integer, required: Token lifetime in seconds (default 3600 = 1 hour).
  - `scope` string: Space-separated list of scopes granted to this token.

## Other responses

- `400`: Invalid request (missing parameters, unsupported grant type, or requested scopes not allowed for the client)
- `401`: Client authentication failed

---

[API](https://skmtc.dev/zenzap/apis/zenzap-external-integration-api.md) - [All operations](https://skmtc.dev/zenzap/apis/zenzap-external-integration-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zenzap/apis/zenzap-external-integration-api/revisions/37faae2c2036?raw)