Get an access token
POST/oauth2/token
Authenticate with your client ID and secret to obtain a Bearer access token.
Send a form-encoded request with grant_type=client_credentials over HTTPS.
The examples use client_secret_basic: your client ID and secret are the
HTTP Basic username and password. As an alternative, client_secret_post
sends client_id and client_secret in the form body and omits Basic authentication.
Use one method per request; credentials are required with either method.
In generated examples, replace {{BASE64_CLIENT_CREDENTIALS}} with the
Base64 encoding of CLIENT_ID:CLIENT_SECRET using your onboarding credentials.
Your HTTP library's Basic authentication option can construct this header for you.
Use expires_in to calculate when the token expires. Reuse the token until
your application's renewal threshold, then request another token with the
same client-credentials flow. This flow returns no refresh token or ID token.
Token failures use an OAuth JSON error response, separate from the API's problem-details responses. See the Cognito token endpoint documentation.
Request
Responses
- 200
- 400
Access token issued. Its lifetime is reported in expires_in.
The token request could not be completed. Check the grant and client credentials before retrying. A client that is not enabled for the grant can produce unauthorized_client.