Create access token

Creates an access token by exchanging OAuth 2.0 client credentials, following RFC 6749 Section 4.4 (Client Credentials Grant).

Authentication: Provide credentials via HTTP Basic Auth (Authorization: Basic base64(client_id:client_secret)) or as client_id and client_secret form parameters in the request body.

Response: Returns a signed JWT (RS256) that can be used as a Bearer token for API access. Use the kid header in the JWT to look up the corresponding public key from the provider signer's key-pair factor for verification.

Note: This endpoint follows the RFC 6749 standard. It accepts application/x-www-form-urlencoded bodies, returns an RFC 6749 token response, and uses standard error codes (invalid_client, invalid_request, etc.).

Usage Examples

curl -X POST "http://localhost:3000/v2/oauth/token" \  -H "x-ledger: <YOUR LEDGER HANDLE>" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d ''

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImxlZGdlci1vYXV0aC1rZXktMSJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

{
  "error": "invalid_request",
  "error_description": "Missing grant_type parameter"
}

{
  "error": "invalid_client",
  "error_description": "Invalid client credentials"
}

{
  "error": "server_error",
  "error_description": "An unexpected error occurred processing the request"
}

Header Parameters

Response Body