Skip to main content

Obtain an access token via OAuth2 client credentials grant

POST 
/auth/client-credentials

Performs the OAuth2 client credentials grant on behalf of a machine client, exchanging a clientId and clientSecret for an access token scoped to this service's configured Auth0 audience. Use this endpoint for automated, non-interactive service accounts and background jobs that do not act on behalf of a human user; for human user login, use POST /auth/login instead. No prior authentication is required to call this endpoint. Both clientId and clientSecret are required and must be non-blank — the server returns 400 if either is missing or empty; this endpoint never falls back to the service's own configured Auth0 credentials, so a caller cannot obtain a token without supplying valid credentials of their own. On success, returns a JSON object containing accessToken, expiresIn (lifetime in seconds), and tokenType (always Bearer). Pass the token as Authorization: Bearer <accessToken> on subsequent requests.

Request​

Responses​

A JSON object containing a bearer access token (accessToken), its lifetime in seconds (expiresIn), and the token type (tokenType, always Bearer).