# Create token

Exchange your `client_id` and `client_secret` for a Bearer
access token (OAuth 2.0 **client credentials**).
- `grant_type` is optional; when sent it must be `client_credentials`.
Any other value returns `400`.
- `scope` in the request body is optional and ignored; scopes on the
token come from your Auth0 client configuration.
- Successful Auth0 responses are returned as **`200`** with the standard
token fields (`access_token`, `token_type`, `expires_in`, `scope`).
- Invalid credentials or Auth0 rejections are passed through (typically
**`401`**) with Auth0's OAuth error body.
- If the authentication provider returns an unexpected or unparsable
response, a **`500`** is returned with the standard API error array.

Step-by-step guide: [Authentication](./index.md#authentication).

Endpoint: POST /accounts/token
Version: 1.0
Security: get-bearer-token-using-oauth2

## Request fields (application/json):

  - `client_id` (string, required)
    Example: your-client-id

  - `client_secret` (string, required)
    Example: your-client-secret

  - `grant_type` (string)
    OAuth 2.0 grant type. If omitted, client_credentials is assumed. Any other value is rejected.
    Enum: "client_credentials"

  - `scope` (string)
    Optional. Ignored; scopes are assigned from the client configuration.
    Example: read:account create:account

## Response 200:

  - `200` (unknown)
    OK — Auth0 issued an access token. Use `access_token` as
`Authorization: Bearer <token>` on subsequent API calls.

## Response 200 fields (application/json):

  - `access_token` (string, required)
    The JWT access token to use for API requests.
    Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

  - `token_type` (string, required)
    The type of token, always "Bearer".
    Example: Bearer

  - `expires_in` (integer, required)
    Seconds until the token expires. Typically `86400` (24 hours).
Request a new token when this elapses — this endpoint does not issue
refresh tokens.
    Example: 86400

  - `scope` (string)
    Space-separated OAuth scopes granted to this client (from Auth0 client
configuration). Product check endpoints generally require a valid token
and an enabled product configuration rather than a specific scope.
    Example: read:account create:account delete:account

## Response 400:

  - `400` (unknown)
    Bad request — for example `grant_type` was provided and is not
`client_credentials`. Body uses the standard API error array.

## Response 400 fields (application/json):

  - `code` (string, required)
    A machine-readable error code.
    Example: invalid_request

  - `title` (string, required)
    A human-readable error title.
    Example: Invalid Request

  - `source` (object)
    An object containing references to the source of the error.

  - `source.pointer` (string)
    A JSON Pointer [RFC6901] to the associated entity in the request document.
    Example: /data/attributes/first_name

## Response 401:

  - `401` (unknown)
    Unauthorized — client credentials were rejected or the token request failed
upstream. Body is Auth0's OAuth error object (not the JSON:API error array
used elsewhere in this API).

## Response 401 fields (application/json):

  - `error` (string, required)
    OAuth error code (for example `access_denied` or `invalid_client`).
    Example: access_denied

  - `error_description` (string)
    Human-readable explanation from the authorization server.
    Example: Unauthorized

## Response 500:

  - `500` (unknown)
    Error response

## Response 500 fields (application/json):

  - `code` (string, required)
    A machine-readable error code.
    Example: invalid_request

  - `title` (string, required)
    A human-readable error title.
    Example: Invalid Request

  - `source` (object)
    An object containing references to the source of the error.

  - `source.pointer` (string)
    A JSON Pointer [RFC6901] to the associated entity in the request document.
    Example: /data/attributes/first_name