# Obtains or refreshes an API token POST {{baseOAuthURL}}/oauth2/token This endpoint obtains or refreshes an API token. The resulting API token may be either a: * Merchant token if it is created from a merchant API key * Partner token if it is created from a partner API key For making an endpoint call, the two token types are neither the same nor interchangeable. The endpoint description specifies the required API key type. By default, a merchant API key is required. Obtaining a new API token or refreshing an existing one uses the same endpoint. However, body fields are different: * Obtaining a new API token uses: * `grant_type = client_credentials` * `scope = offline_access` * Refreshing an existing API token uses: * `grant_type = refresh_token` * adds the refresh token * does not use `scope` The examples below illustrate these request body fields. The differences are in bold.
Obtain token
Set the body type to `x-www-form-urlencoded`.

Body fields:
grant_type = client_credentials
scope = offline_access
client_id = u0LJUTc...BKhM3L
client_secret = eyJhbG...d7iXs 		Refresh token
Set the body type to `x-www-form-urlencoded`.

Body fields:
grant_type = refresh_token
refresh_token = YhjQpM...EVkVuB
scope = offline_access
client_id = u0LJUTc...BKhM3L-y
client_secret = eyJhbG...d7iXs
Endpoint: POST /oauth2/token Version: V1 Security: Bearer ## Request fields (application/x-www-form-urlencoded): - `client_id` (string, required) Specifies client ID from the API key for the account. Example: 59483870959438697242c Example: 59483870959438697242c - `client_secret` (string, required) Specifies the client secret from the API key for the account. Example: 9eb2c6859daa4d8ae5da02a9 Example: 9eb2c6859daa4d8ae5da02a9 - `grant_type` (string, required) Specifies the literal value `client_credentials`. If obtaining an API token, use: `client_credentials` If refreshing an API token, use: `refresh_token` Example: client_credentials Example: client_credentials - `scope` (string, required) Specifies the literal value `offline_access`. Use only for obtaining an API token. Omit when refreshing an API token. Example: offline_access Example: offline_access ## Response 200 fields (application/json): - `access_token` (string, required) Indicates the API token. Example: 213bf7a8-9b0c-4d1e-2f3a-4b5c6d7e8f14 Example: 213bf7a8-9b0c-4d1e-2f3a-4b5c6d7e8f14 - `token_type` (string, required) Indicates the token type. Example: Bearer Example: Bearer - `expires_in` (integer) Indicates the expiry, or lifetime, (in seconds) of the API token. Example: 900 Example: 900 - `refresh_token` (string) Indicates the refresh token (only for authorization_code grant). Example: 324c08b9-0c1d-4e2f-3a4b-5c6d7e8f9a25 Example: 324c08b9-0c1d-4e2f-3a4b-5c6d7e8f9a25 - `scope` (string) Indicates the granted scopes, space-delimited. Example: null Example: null ## Response 400 fields (application/json): - `details` (string) Indicates details about the error. Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error - `statusCode` (integer) Specifies the HTTP response status code. This is the HTTP status code returned by the attempted delivery. The following is a list of HTTP response status codes that include but are not limited to: | HTTP Status | Meaning | | --- | --- | | 200 | Delivery succeeded | | 400 | Bad request | | 401 | Unauthorized | | 404 | Endpoint not found | | 429 | Rate limited | Example: 401 Example: 401 - `source` (string) Indicates the source of the error. Example: Example: - `exceptionType` (string) Indicates the error's exception type. Example: FluentValidation.ValidationException Example: FluentValidation.ValidationException - `correlationId` (string) Indicates the correlation identifier. Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef - `entityId` (string) Indicates the entity identifier. Example: null - `errorCode` (string) Indicates the error code. Example: null ## Response 401 fields (application/json): - `details` (string) Indicates details about the error. Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error Example: Validation failed: -- Email: 'Email' is not a valid email address. Severity: Error - `statusCode` (integer) Specifies the HTTP response status code. This is the HTTP status code returned by the attempted delivery. The following is a list of HTTP response status codes that include but are not limited to: | HTTP Status | Meaning | | --- | --- | | 200 | Delivery succeeded | | 400 | Bad request | | 401 | Unauthorized | | 404 | Endpoint not found | | 429 | Rate limited | Example: 401 Example: 401 - `source` (string) Indicates the source of the error. Example: Example: - `exceptionType` (string) Indicates the error's exception type. Example: FluentValidation.ValidationException Example: FluentValidation.ValidationException - `correlationId` (string) Indicates the correlation identifier. Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef Example: aa6cfcd0-0295-4a4c-b074-8c901f114fef - `entityId` (string) Indicates the entity identifier. Example: null - `errorCode` (string) Indicates the error code. Example: null - `title` (string) - `cause` (string) - `resolution` (string) - `documentationUrl` (string) ## Response 500 fields (application/json): - `details` (string) - `statusCode` (integer) Specifies the HTTP response status code. This is the HTTP status code returned by the attempted delivery. The following is a list of HTTP response status codes that include but are not limited to: | HTTP Status | Meaning | | --- | --- | | 200 | Delivery succeeded | | 400 | Bad request | | 401 | Unauthorized | | 404 | Endpoint not found | | 429 | Rate limited | Example: 401 Example: 401 - `source` (string) - `exceptionType` (string) - `correlationId` (string) - `entityId` (string) - `errorCode` (string)