Access token for an API integration (e.g. a factory station) with the client_credentials grant. Valid for 5 minutes, no refresh token.
For software that calls the API without a person: factory stations, server-to-server integrations. An organization administrator creates an API integration (Administration → API integrations), gives it a role on the machine groups it needs, and copies its client_id and secret; the secret is shown only once and can be rotated or revoked at any time. Personal credentials (username and password, Get access token) must not be used by such systems. See Provisioning from a factory station.
POST https://auth.things5.digital/auth/realms/{realm-id}/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id={client_id}&client_secret={secret}
| Parameter | Description |
|---|---|
realm-id | Your realm, see General parameters. |
grant_type | Always client_credentials. |
client_id, client_secret | Of the API integration. |
Responses
200: send access_token as Authorization: Bearer <access_token>. It is valid for 5 minutes and there is no refresh token: request a new one when it expires.
{ "access_token": "eyJhbGciOi…", "expires_in": 300, "token_type": "Bearer", "scope": "profile email" }
401: unknown client_id, wrong or rotated secret, or revoked integration.
{ "error": "unauthorized_client", "error_description": "Invalid client or Invalid client credentials" }