Skip to main content

​
Endpoint

POST /oauth/token This is the OAuth 2.0 grant that server processes use to access an API. Use this endpoint to directly request an access token by using the application’s credentials (a Client ID and a Client Secret).

​
Responses

​
200

A successful response will return an access token.

​
Learn More

​
Headers

​
string
A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.

​
Body Parameters

The request body is in application/x-www-form-urlencoded format.
​
string
required
Denotes the flow you are using. For Client Credentials use client_credentials.Allowed values: client_credentials
​
string
required
Your application’s Client ID.
​
string
required
Your application’s Client Secret.
​
string
required
The unique identifier of the target API you want to access.
​
string
The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to audience when the tenant’s Resource Parameter Compatibility Profile is set to compatibility.
​
string
[Recommended]The organization or identifier with which you want the request to be associated. To learn more, read Machine-to-Machine Access for Organizations.

​
Response Schema

​
Agent access tokens

Agents as principals is an Early Access feature.
When the requesting application is linked to an agent and agent subject claims are enabled for the target API, the issued access token identifies the agent as the subject:
  • The sub claim is the agent identifier (for example, agt_72jbvv7LfRKYp59gtRLtkn) instead of the application Client ID.
  • The token includes sub_profile: "ai_agent" and client_profile: "service ai_agent".
For a non-agent Machine-to-Machine application calling an API with agent subject claims enabled, the sub claim is the application Client ID without the @clients suffix. The response shape (access_token, token_type, expires_in) is unchanged; these are claims inside the issued JWT. To learn more, read Access Token Profiles.

​
Response Messages