# API Token Authentication

An API token is required for each endpoint use.
An API token can only be created after an account is created, registered, and at least one API key has been created.
The API token is required for each endpoint.
It is an encrypted string that combines the client Id and client secret from an API key (created earlier).
It contains authentication and authorization coding.
This includes any privileges the user or account affords.
Being encrypted means the API token is safe to expose in frontend code.
The API token is time-sensitive and expires after an amount of time.
It may be created as needed.
We recommend generating a new API token before each endpoint use.
This ensures the API token will be valid for each call.
The API token is an OAuth 2.0 Client Credentials authorization flow.
The Client Credentials Flow is an OAuth 2.0 authorization Bearer grant.
This means a server-side application obtains an access token using its client credentials (client ID and client secret) to protect resources.

 - [Authentication baseURLs](https://developer.flute.com/api-reference/v2/flute-v2/api-token-authentication/authentication-baseurls.md): ### Authentication baseURLs An API token is created for the environment it will be used in. There are two available Flute environments: **Sandbox** and **Production**. The sandbox and production envi
 - [Using the API Token](https://developer.flute.com/api-reference/v2/flute-v2/api-token-authentication/using-the-api-token.md): ### Using the API Token The token endpoint returns both an `access_token` and a `refresh_token`. The lifespan of the `access_token` is indicated by the `expires_in` value. The lifespan of the `refresh
 - [Error Responses](https://developer.flute.com/api-reference/v2/flute-v2/api-token-authentication/error-responses.md): ### Error Responses If authentication fails, the token endpoint returns an error. The following are commonly encountered errors. | HTTP Status | Common Cause | | --- | --- | | 400 Bad Request | Missi
 - [POST /oauth2/token](https://developer.flute.com/api-reference/v2/flute-v2/api-token-authentication/get-oauth-token.md): POST {{authBaseURL}}/oauth2/token This endpoint obtains or refreshes an API token. Each Flute endpoint (with the exception of this authentication endpoint) requires an API token, also called an access