Skip to main content
POST
Sign in
Send the clientId and clientSecret of an API client as HTTP Basic credentials in the Authorization header, and grantType: "client_credentials" in the body. Then call the API with Authorization: Bearer <accessToken>. Tokens are valid for 60 minutes; when one expires, sign in again. A deactivated API client can’t sign in.

Authorizations

Authorization
string
header
required

Basic authentication header of the form Basic <encoded-value>, where <encoded-value> is the base64-encoded string username:password.

Body

application/json
grantType
enum<string>
required

Must be client_credentials. Send your API client's clientId and clientSecret as HTTP Basic credentials in the Authorization header: Basic base64(clientId:clientSecret).

Available options:
client_credentials
Example:

"client_credentials"

Response

Successful response

Tokens issued to an API client.

accessToken
string
required

Send it as Authorization: Bearer <accessToken> on every request. Valid for 60 minutes: sign in again when it expires.

Example:

"eyJraWQiOiJrMSJ9.eyJzdWIiOiI0MzIzIn0.c2lnbmF0dXJl"

idToken
string
required

JWT with the API client's identity claims. Not needed to call the API. Valid for 60 minutes.

Example:

"eyJraWQiOiJrMiJ9.eyJzdWIiOiI0MzIzIn0.c2lnbmF0dXJl"

refreshToken
string
required

Not used by API clients: when the access token expires, sign in again.

Example:

"eyJjdHkiOiJKV1QifQ.cmVmcmVzaA.aXY.Y2lwaGVy.dGFn"