> ## Documentation Index
> Fetch the complete documentation index at: https://sendcloud.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth 2.0 token

> Use this endpoint to get a new OAuth 2.0 access token.

Sendcloud supports the OAuth 2.0 **client credentials** grant, which is intended for server-to-server integrations where your application acts on its own behalf.

Send your client ID and client secret using HTTP Basic authentication, with `grant_type=client_credentials` and `scope=api`:

```bash
curl -X POST https://account.sendcloud.com/oauth2/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "scope=api"
```

Use the returned `access_token` as a bearer token on subsequent API requests:

```
Authorization: Bearer ory_at_dK...
```

<Note>
  Access tokens expire **1 hour** after they are issued. The client credentials grant does not return a refresh token: your application already holds its client credentials and can request a new access token at any time. Cache the access token and request a new one shortly before it expires, instead of requesting a token for every API call. The token endpoint returns a `expires_in` field, use this to cache the bearer token and refresh just before it expires.
</Note>

You can find a list of open-source libraries to help with OAuth 2.0 authentication at [https://oauth.net/code/](https://oauth.net/code/)


## OpenAPI

````yaml /.openapi/v3/auth/openapi.yaml post /oauth2/token
openapi: 3.1.0
info:
  title: Authentication
  version: 2.0.0
  description: Provides details on how to obtain authentication
  contact:
    name: Sendcloud API Support
    url: https://www.sendcloud.dev
    email: contact@sendcloud.com
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
  - url: https://account.sendcloud.com
    description: Production
security: []
tags:
  - description: Authentication
    name: auth
paths:
  /oauth2/token:
    post:
      tags:
        - oAuth2
      summary: OAuth 2.0 token
      description: Use this endpoint to get a new OAuth 2.0 access token.
      operationId: OAuth2TokenExchange
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              properties:
                grant_type:
                  description: >-
                    The OAuth 2.0 grant type. Only `client_credentials` is
                    supported.
                  enum:
                    - client_credentials
                  example: client_credentials
                  type: string
                  x-formData-name: grant_type
                scope:
                  description: >-
                    The scope to request for the access token. Must be set to
                    `api`,

                    which grants access to the Sendcloud API.
                  example: api
                  type: string
                  x-formData-name: scope
                client_id:
                  description: >-
                    Your OAuth 2.0 client ID. You can omit this field when you
                    send your

                    client ID and client secret using HTTP Basic authentication.
                  type: string
                  x-formData-name: client_id
              required:
                - grant_type
              type: object
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2TokenExchange'
              examples:
                client_credentials_example:
                  summary: Access token issued for the client credentials grant
                  value:
                    access_token: ory_at_dK...
                    expires_in: 3599
                    scope: api
                    token_type: bearer
          description: OAuth2TokenExchange
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorOAuth2'
          description: ErrorOAuth2
      security:
        - basic: []
components:
  schemas:
    OAuth2TokenExchange:
      description: OAuth2 Token Exchange Result
      properties:
        access_token:
          description: The access token issued by the authorization server.
          example: ory_at_dK...
          type: string
        expires_in:
          description: |-
            The lifetime in seconds of the access token. Access tokens issued
            through the client credentials grant expire 1 hour after they are
            issued, so this value is always close to `3600`.
          example: 3599
          format: int64
          type: integer
        scope:
          description: The scope of the access token
          example: api
          type: string
        token_type:
          description: The type of the token issued
          example: bearer
          type: string
      type: object
    ErrorOAuth2:
      description: Error
      properties:
        error:
          description: Error
          type: string
        error_debug:
          description: |-
            Error Debug Information

            Only available in dev mode.
          type: string
        error_description:
          description: Error Description
          type: string
        error_hint:
          description: |-
            Error Hint

            Helps the user identify the error cause.
          example: The redirect URL is not allowed.
          type: string
        status_code:
          description: HTTP Status Code
          example: 401
          format: int64
          type: integer
      type: object
  securitySchemes:
    basic:
      scheme: basic
      type: http

````