> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # Sign in > Exchanges your API client's credentials for an access token. Send the `clientId` and `clientSecret` of an API client as HTTP Basic credentials in the `Authorization` header, and `grantType: "client_credentials"` in the body. Then call the API with `Authorization: Bearer `. Tokens are valid for 60 minutes; when one expires, sign in again. A deactivated API client can't sign in. ## OpenAPI ````yaml /api-reference/identity.openapi.json post /auth/sign-in openapi: 3.0.3 info: title: Identity version: 1.0.0 description: >- Portão 3 identity API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). 4 app groups run without the identity authorizer; publicPatterns enumerates every route they expose, except POST /auth/sign-in, documented with HTTP Basic for the API-client credentials flow. Confidence tiers: generated:typed=45 copied:manual=0 unknown=0. servers: - url: https://api.identity.v2.portao3.com.br/ description: production - url: https://api.identity.dev.3pers.com.br/ description: development security: [] tags: - name: Authentication - name: Current User - name: Custom Fields - name: API Clients - name: Users - name: Organizations - name: Groups - name: Realms paths: /auth/sign-in: post: tags: - Authentication summary: Sign in description: Exchanges your API client's credentials for an access token. operationId: postAuthSignIn parameters: [] requestBody: required: true content: application/json: schema: type: object properties: grantType: type: string enum: - client_credentials description: >- Must be `client_credentials`. Send your API client's `clientId` and `clientSecret` as HTTP Basic credentials in the `Authorization` header: `Basic base64(clientId:clientSecret)`. example: client_credentials required: - grantType responses: '200': description: Successful response content: application/json: schema: type: object properties: accessToken: type: string description: >- Send it as `Authorization: Bearer ` on every request. Valid for 60 minutes: sign in again when it expires. example: eyJraWQiOiJrMSJ9.eyJzdWIiOiI0MzIzIn0.c2lnbmF0dXJl idToken: type: string description: >- JWT with the API client's identity claims. Not needed to call the API. Valid for 60 minutes. example: eyJraWQiOiJrMiJ9.eyJzdWIiOiI0MzIzIn0.c2lnbmF0dXJl refreshToken: type: string description: >- Not used by API clients: when the access token expires, sign in again. example: eyJjdHkiOiJKV1QifQ.cmVmcmVzaA.aXY.Y2lwaGVy.dGFn required: - accessToken - idToken - refreshToken description: Tokens issued to an API client. '401': description: >- `INVALID_CREDENTIALS` — The credentials are wrong, or the API client is deactivated. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - INVALID_CREDENTIALS description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: INVALID_CREDENTIALS origin: IDENTITY message: invalid_credentials '403': description: >- `AUTH_ATTEMPT_BLOCKED` — The sign-in was blocked by Portão 3's fraud protection. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - AUTH_ATTEMPT_BLOCKED description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: AUTH_ATTEMPT_BLOCKED origin: IDENTITY message: >- This attempt was blocked for security reasons. If you believe this is a mistake, contact support. '422': description: >- `BAD_REQUEST` — The body or the `Authorization` header is missing or malformed; `fields` lists each problem. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - IDENTITY description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: IDENTITY message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: grantType message: 'Invalid input: expected string, received undefined' code: GRANTTYPE_REQUIRED security: - basicAuth: [] components: securitySchemes: basicAuth: type: http scheme: basic ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.