Oauth 2.0 Client Credentials Token

Overview

This request retrieves an OAuth 2.0 access token using the Client Credentials grant.

Use it as a prerequisite step before calling any protected endpoints that require:

Authorization: Bearer

Endpoint: POST {{uatAPI}}/oauth/token
Content-Type: application/x-www-form-urlencoded

Prerequisites (variables)

Make sure the following variables are set in the active scope:

{{uatAPI}} — Base URL for the UAT API host

{{issuerTIN}} — OAuth client id (VAT number / TIN)

{{apiKey}} — OAuth client secret (API key)

Request body (x-www-form-urlencoded)

Field	Value	Required	Notes
`grant_type`	`client_credentials`	Yes	Must be exactly `client_credentials`
`client_id`	`{{issuerTIN}}`	Yes	Client identifier (TIN)
`client_secret`	`{{apiKey}}`	Yes	Client secret (API key)

Successful response (200 OK)

Typical fields returned:

access_token — Token to use in Authorization: Bearer ...

token_type — Usually Bearer

expires_in — Token lifetime in seconds

refresh_token — Refresh token

Common error (400 Bad Request)

Example:

{
  "error": "invalid_request",
  "error_description": "Invalid credentials"
}

This usually means:

client_id / client_secret is wrong, or

credentials are not valid for the selected {{uatAPI}} environment.

How to use in downstream requests

Add a header in protected(Bearer ) requests:

Authorization: Bearer {{oauthAccessToken}}

the (POST {{uatAPI}}/oauth/token) supports refresh, use the refresh-token request (grant_type refresh_token) to obtain a new access token.

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Responses

🟢200Success

application/json

Body

Example

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkVMMTU0Njk3MzkxIiwicm9sZSI6IlBPU1QiLCJuYmYiOjE3NzQzNjgyMTYsImV4cCI6MTc3NDM2OTExNiwiaWF0IjoxNzc0MzY4MjE2fQ.v-J1x8N-7uTR3uFBU4mk8gv8-_jhOulKgKpCVVgm8eE",
    "token_type": "Bearer",
    "expires_in": 900,
    "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkVMMTU0Njk3MzkxIiwicm9sZSI6IlBPU1QiLCJuYmYiOjE3NzQzNjgyMTYsImV4cCI6MTc3NDk3MzAxNiwiaWF0IjoxNzc0MzY4MjE2fQ.nVpVeLSy4CKN49SJnE7by3NnmjJi3U1W6qNHQshz1zU"
}

🟠400Bad Request

Oauth 2.0 Client Credentials Token

Overview#

Prerequisites (variables)#

Request body (x-www-form-urlencoded)#

Successful response (200 OK)#

Common error (400 Bad Request)#

How to use in downstream requests#

Request