Skip to content

Accounts

Account credentialing and OAuth 2.0 client credentials token issuance (POST /accounts/token). See Authentication for the end-to-end flow. Account creation and environment setup are done with a Checkr Account Executive.

Operations

Create token

Request

Exchange your client_id and client_secret for a Bearer access token (OAuth 2.0 client credentials).

  • grant_type is optional; when sent it must be client_credentials. Any other value returns 400.
  • scope in the request body is optional and ignored; scopes on the token come from your Auth0 client configuration.
  • Successful Auth0 responses are returned as 200 with the standard token fields (access_token, token_type, expires_in, scope).
  • Invalid credentials or Auth0 rejections are passed through (typically 401) with Auth0's OAuth error body.
  • If the authentication provider returns an unexpected or unparsable response, a 500 is returned with the standard API error array.

Step-by-step guide: Authentication.

Bodyapplication/jsonrequired
client_idstringrequired
Example:"your-client-id"
client_secretstringrequired
Example:"your-client-secret"
grant_typestring

OAuth 2.0 grant type. If omitted, client_credentials is assumed. Any other value is rejected.

Value:"client_credentials"
Example:"client_credentials"
scopestring

Optional. Ignored; scopes are assigned from the client configuration.

Example:"read:account create:account"
curl -i -X POST \
  https://api.checkrtrust.com/v1/accounts/token \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "grant_type": "client_credentials",
    "scope": "read:account create:account"
  }'

Responses

OK — Auth0 issued an access token. Use access_token as Authorization: Bearer <token> on subsequent API calls.

Bodyapplication/json
access_tokenstringrequired

The JWT access token to use for API requests.

Example:"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
token_typestringrequired

The type of token, always "Bearer".

Example:"Bearer"
expires_inintegerrequired

Seconds until the token expires. Typically 86400 (24 hours). Request a new token when this elapses — this endpoint does not issue refresh tokens.

Example:86400
scopestring

Space-separated OAuth scopes granted to this client (from Auth0 client configuration). Product check endpoints generally require a valid token and an enabled product configuration rather than a specific scope.

Example:"read:account create:account delete:account"
Response
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "read:account create:account delete:account"
}