To access your API, you must request an access token when authenticating a user.
These Auth0 tools help you modify your application to authenticate users:
Quickstarts are the easiest way to implement authentication. They show you how to use Universal Login and Auth0's language- and framework-specific SDKs.
The Auth0 Authentication API is a reference for those who prefer to write code independently. First, identify which flow to use. Then follow the instructions to implement that flow.
To request an access token, make a POST call to the token URL.
Example POST to token URL
- cURL
- C#
- Go
- Java
- Node.JS
- Obj-C
- ...
- PHP
- Python
- Ruby
- Swift
curl --request POST \ --url 'https://{yourDomain}/oauth/token' \ --header 'content-type: application/x-www-form-urlencoded' \ --data grant_type=client_credentials \ --data client_id=YOUR_CLIENT_ID \ --data client_secret=YOUR_CLIENT_SECRET \ --data audience=YOUR_API_IDENTIFIERWas this helpful?
/
var client = new RestClient("https://{yourDomain}/oauth/token");var request = new RestRequest(Method.POST);request.AddHeader("content-type", "application/x-www-form-urlencoded");request.AddParameter("application/x-www-form-urlencoded", "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_API_IDENTIFIER", ParameterType.RequestBody);IRestResponse response = client.Execute(request);Was this helpful?
/
package mainimport ("fmt""strings""net/http""io/ioutil")func main() {url := "https://{yourDomain}/oauth/token"payload := strings.NewReader("grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_API_IDENTIFIER")req, _ := http.NewRequest("POST", url, payload)req.Header.Add("content-type", "application/x-www-form-urlencoded")res, _ := http.DefaultClient.Do(req)defer res.Body.Close()body, _ := ioutil.ReadAll(res.Body)fmt.Println(res)fmt.Println(string(body))}Was this helpful?
/
HttpResponse<String> response = Unirest.post("https://{yourDomain}/oauth/token") .header("content-type", "application/x-www-form-urlencoded") .body("grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_API_IDENTIFIER") .asString();Was this helpful?
/
var axios = require("axios").default;var options = { method: 'POST', url: 'https://{yourDomain}/oauth/token', headers: {'content-type': 'application/x-www-form-urlencoded'}, data: new URLSearchParams({ grant_type: 'client_credentials', client_id: 'YOUR_CLIENT_ID', client_secret: 'YOUR_CLIENT_SECRET', audience: 'YOUR_API_IDENTIFIER' })};axios.request(options).then(function (response) { console.log(response.data);}).catch(function (error) { console.error(error);});Was this helpful?
/
#import <Foundation/Foundation.h>NSDictionary *headers = @{ @"content-type": @"application/x-www-form-urlencoded" };NSMutableData *postData = [[NSMutableData alloc] initWithData:[@"grant_type=client_credentials" dataUsingEncoding:NSUTF8StringEncoding]];[postData appendData:[@"&client_id=YOUR_CLIENT_ID" dataUsingEncoding:NSUTF8StringEncoding]];[postData appendData:[@"&client_secret=YOUR_CLIENT_SECRET" dataUsingEncoding:NSUTF8StringEncoding]];[postData appendData:[@"&audience=YOUR_API_IDENTIFIER" dataUsingEncoding:NSUTF8StringEncoding]];NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://{yourDomain}/oauth/token"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0];[request setHTTPMethod:@"POST"];[request setAllHTTPHeaderFields:headers];[request setHTTPBody:postData];NSURLSession *session = [NSURLSession sharedSession];NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }];[dataTask resume];Was this helpful?
/
$curl = curl_init();curl_setopt_array($curl, [ CURLOPT_URL => "https://{yourDomain}/oauth/token", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_POSTFIELDS => "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_API_IDENTIFIER", CURLOPT_HTTPHEADER => [ "content-type: application/x-www-form-urlencoded" ],]);$response = curl_exec($curl);$err = curl_error($curl);curl_close($curl);if ($err) { echo "cURL Error #:" . $err;} else { echo $response;}Was this helpful?
/
import http.clientconn = http.client.HTTPSConnection("")payload = "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_API_IDENTIFIER"headers = { 'content-type': "application/x-www-form-urlencoded" }conn.request("POST", "/{yourDomain}/oauth/token", payload, headers)res = conn.getresponse()data = res.read()print(data.decode("utf-8"))Was this helpful?
/
require 'uri'require 'net/http'require 'openssl'url = URI("https://{yourDomain}/oauth/token")http = Net::HTTP.new(url.host, url.port)http.use_ssl = truehttp.verify_mode = OpenSSL::SSL::VERIFY_NONErequest = Net::HTTP::Post.new(url)request["content-type"] = 'application/x-www-form-urlencoded'request.body = "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&audience=YOUR_API_IDENTIFIER"response = http.request(request)puts response.read_bodyWas this helpful?
/
import Foundationlet headers = ["content-type": "application/x-www-form-urlencoded"]let postData = NSMutableData(data: "grant_type=client_credentials".data(using: String.Encoding.utf8)!)postData.append("&client_id=YOUR_CLIENT_ID".data(using: String.Encoding.utf8)!)postData.append("&client_secret=YOUR_CLIENT_SECRET".data(using: String.Encoding.utf8)!)postData.append("&audience=YOUR_API_IDENTIFIER".data(using: String.Encoding.utf8)!)let request = NSMutableURLRequest(url: NSURL(string: "https://{yourDomain}/oauth/token")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0)request.httpMethod = "POST"request.allHTTPHeaderFields = headersrequest.httpBody = postData as Datalet session = URLSession.sharedlet dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) }})dataTask.resume()Was this helpful?
/
Parameters
| Parameter Name | Description |
|---|---|
grant_type | Set this to "client_credentials". |
client_id | Your application's Client ID. You can find this value on the application's settings tab. |
client_secret | Your application's Client Secret. You can find this value on the application's settings tab. To learn more about available application authentication methods, read Application Credentials. |
audience | The audience for the token, which is your API. You can find this in the Identifier field on your API's settings tab. |
Response
You receive an HTTP 200 response with a payload containing access_token, token_type, and expires_in values:
{ "access_token":"eyJz93a...k4laUWw", "token_type":"Bearer", "expires_in":86400}Was this helpful?
/
Validate your tokens before saving them. To learn how, read Validate ID Tokens and Validate Access Tokens.
Control access token audience
When a user authenticates, you request an access token and include the target audience and scope of access in your request. The application uses the /authorize endpoint to request access. This access is both requested by the application and granted by the user during authentication
You can configure your tenant to always include a default audience.
| Token Use | Format | Requested Audience | Requested Scope |
|---|---|---|---|
| /userinfo endpoint | Opaque | tenant name ({yourDomain}), no value for audience parameter, no audience parameter passed | openid |
| Auth0 Management API | JWT | Management API v2 identifier (https://{tenant}.auth0.com/api/v2/) | |
| Your own custom API | JWT | The API Identifier for your custom API registered in the Auth0 Dashboard |
In only one specific instance, access tokens can have multiple target audiences. This requires that your custom API's signing algorithm is set to RS256. To learn more, read Token Best Practices.
Multiple audiences
If you specify an audience of your custom API identifier and a scope of openid, then the resulting access token's aud claim will be an array rather than a string, and the access token will be valid for both your custom API and for the /userinfo endpoint. Your access tokens can only have two or more audiences if you use a single custom API as well as Auth0's /userinfo endpoint.
Custom domains and the Auth0 Management API
Auth0 issues tokens with an issuer (iss) claim of whichever domain you used when requesting the token. Custom domain users can use either their custom domain or their Auth0 domain.
For example, suppose you have a custom domain, https://login.northwind.com. If you request an access token from https://login.northwind.com/authorize, your token's iss claim will be https://login.northwind.com/. However, if you request an access token from https://northwind.auth0.com/authorize, your token's iss claim will be https://northwind.auth0.com/.
If you request an access token from your custom domain with the target audience of the Auth0 Management API, then you must call the Auth0 Management API from your custom domain. Otherwise your access token is considered invalid.
Renew access tokens
By default, an access token for a custom API is valid for 86400 seconds (24 hours). You can shorten the time period before the token expires.
After an access token has expired, you can renew your access token. To do so either re-authenticate the user using Auth0 or use a refresh token.
