> ## Documentation Index > Fetch the complete documentation index at: https://docs.cocoondata.com/llms.txt > Use this file to discover all available pages before exploring further. # /api/oauth/token ## URL structure ```text theme={null} https://access-service.xy-company.com/api/oauth/token ``` ## Supported methods and overview * `POST` - used to obtain for an [access token](/3.2/admin-platform/configuring-client-applications.md#grant-types) (and optional refresh token) representing a Covata user (typically within an [organization](/3.2/admin-org/administering-users-within-an-organisation.md)) using either the *authorization code* or *password* OAuth 2.0 grant types. ## Detailed description This API endpoint serves a number of purposes: * Completes authorization to obtain an access token (and optionally a refresh token) when using the OAuth 2.0 [authorization code](/3.2/api/authentication-and-authorisation.md#using-the-authorization-code-grant-type-step-3) grant type. * Initiates a request for an access token (and optionally a refresh token) using the OAuth 2.0 [password](/3.2/api/authentication-and-authorisation.md#using-the-password-grant-type) grant type grant type. ## Required headers The request's header requires [HTTP Basic authentication](http://tools.ietf.org/html/rfc1945#section-11.1), whose value is the string value of your application's client ID and client secret (separated by a colon) and encoded with [Base64](https://tools.ietf.org/html/rfc4648). > [!NOTE] > > The client ID and client secret values constitute your application's client credentials, which would have been generated when your application was [registered](/3.2/api/authentication-and-authorisation.md#registering-your-application-on-the-platform) on the Covata Platform. Also see [Configuring client applications](/3.2/admin-platform/configuring-client-applications.md) in the Safe Share Administrator's Guide for more information. For example, encoding: * `exampleClientApplication:exampleClientApplicationSecret` \ with Base64 results in the value: * `ZXhhbXBsZUNsaWVudEFwcGxpY2F0aW9uOmV4YW1wbGVDbGllbnRBcHBsaWNhdGlvblNlY3JldA==` Therefore, the HTTP Basic authentication header would be: * `Authentication: Basic ZXhhbXBsZUNsaWVudEFwcGxpY2F0aW9uOmV4YW1wbGVDbGllbnRBcHBsaWNhdGlvblNlY3JldA==` The request also requires form URL-encoded data in the body: * `Content-Type: application/x-www-form-urlencoded` ## Required parameters The following required parameter must be sent in the body of the request (as form URL-encoded data): * **grant\_type** - The grant type used in the authentication and authorization request/s to the Covata Platform. Specify a value of: * `password` for the password grant type \ *or* * `authorization_code` for the authorization code grant type. ## Grant type-specific parameters In addition to the [required parameters](/3.2/api/access-service-api-oauth-token.md#access-service-api-oauth-token-required-parameters) above, some of the following parameters are *also required* based on the grant type used and should be included in the body of the request (as form URL-encoded data): * **code** ( *Required when using the authorization code grant type* ) - The authorization code itself, which is retrieved in the response from the Covata Platform (i.e. following an initial request to [\/api/oauth/authorize](/3.2/api/access-service-api-oauth-authorize.md) to initiate the process for obtaining an access token). * **redirect\_uri** ( *Required when using the authorization code grant type* ) - The redirect URI that was submitted in the initial request to [\/api/oauth/authorize](/3.2/api/access-service-api-oauth-authorize.md) to retrieve an access token. The value specified here is only used validate that it matches the **redirect\_uri** value specified in this initial request. * **username** ( *Required when using the password grant type* ) - The email address of a Covata user's credentials (acquired through your application). * **password** ( *Required when using the password grant type* ) - The password of a Covata user's credentials (acquired through your application). **Example (request parameters - using the password grant type):** ```text theme={null} grant_type=password&username=alex.originator%40covata.com&password=password1 ``` ## Returns A JSON-formatted response containing the following members: * **access\_token** - The access token itself, as a [JSON Web Token (JWT)](https://jwt.io/introduction/) value. The resources (i.e. API endpoints) of the Covata Platform that this access token grants permission to are based on the Covata user whose credentials were used for authentication, that user's [roles](/3.2/admin-org/administering-users-within-an-organisation.md#an-organisation-users-roles) (explained in more detail in the [Organization Administrator's Guide](/3.2/admin-org.md)) and if applicable to the API endpoint, the user's: * membership of organizations and * ownership or collaborator status on files or folders. * **token\_type** - The brief description for the type of token (above) - i.e. usually `bearer`. * **refresh\_token** - The refresh token itself, as a universally unique identifier (UUID) value. This value will not be present if the configuration of your client application on the Covata Platform does not permit refresh tokens to be issued. See [Registering your application on the Covata Platform](/3.2/api/authentication-and-authorisation.md#registering-your-application-on-the-platform) for more information. * **jti** - The UUID value for the JWT access token issued in this response. This value is a unique ID for the JWT issued in this response and is also known as a JWT ID. **Example (response):** ```json theme={null} { "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0NjcwMTY2NjYsInVzZXJfbmFtZSI6ImFsZXgub3JpZ2luYXRvckB4eS1jb21wYW55LmNvbSIsImF1dGhvcml0aWVzIjpbIlBFUk1fRklMRV9ERUxFVEUiLCJQRVJNX0FQUF9BUFBST1ZBTF9SRVZPS0UiLCJQRVJNX1ZJRVciLCJQRVJNX1VTRVJJTkZPX0dFVF9OT1RJRllfUFJFRiIsIlBFUk1fUFJJTlQiLCJQRVJNX0FQSV9WMV9BQ0NFU1MiLCJQRVJNX1NFTEZfUkVWT0tFX1RPS0VOUyIsIlBFUk1fTU9WRSIsIlBFUk1fVVNFUklORk9fR0VUU0VMRiIsIlBFUk1fUkVOQU1FIiwiUEVSTV9BUElfT0FVVEhfQUNDRVNTIiwiUEVSTV9WSUVXX09USEVSIiwiUEVSTV9ERVZJQ0VfQVVUSEVOVElDQVRJT04iLCJQRVJNX0ZJTEVfQUREIiwiUEVSTV9DT05UQUNUU19MSVNUIiwiUEVSTV9GT0xERVJfQUREIiwiUEVSTV9VU0VSSU5GT19FRElUX05PVElGWV9QUkVGIiwiUEVSTV9GT0xERVJfREVMRVRFIiwiUk9MRV9PUklHSU5BVE9SIiwiUEVSTV9PQVVUSF9UT0tFTl9SRVZPS0UiLCJQRVJNX1NFTkRfSVRFTV9OT1RJRklDQVRJT04iLCJQRVJNX1NIQVJFIiwiUEVSTV9BUElfQUNDT1VOVF9BQ0NFU1MiLCJQRVJNX0RPV05MT0FEIiwiUEVSTV9DT05UQUNUU19VUERBVEUiLCJQRVJNX0xBQkVMX0xJU1QiLCJQRVJNX0FQUF9BUFBST1ZBTF9MSVNUIiwiUEVSTV9PUkdBTklTQVRJT05fR0VUU0VMRiIsIlBFUk1fT0FVVEhfVE9LRU5fTElTVF9CWV9DTElFTlQiLCJQRVJNX0FQSUNMSUVOVF9BREQiLCJQRVJNX0FQSUNMSUVOVF9MSVNUIiwiUEVSTV9ERUxFVEVfT1RIRVIiLCJQRVJNX09BVVRIX1RPS0VOX0xJU1QiLCJQRVJNX0FERFJFU1NCT09LX0xJU1QiLCJQRVJNX0NPUFkiLCJQRVJNX0NPTlRBQ1RTX0NSRUFURSIsIlBFUk1fUkVNT1ZFX1NFTEYiLCJQRVJNX0NPTlRBQ1RTX0RFTEVURSIsIlBFUk1fVVNFUklORk9fVVBEQVRFIl0sImp0aSI6ImYxY2Q4NGVhLWM2ZTgtNDc4OC04NzliLTEzZDM0ZDQ0ZDUyNiIsImNsaWVudF9pZCI6ImV4YW1wbGVDbGllbnRBcHBsaWNhdGlvbiIsInNjb3BlIjpbIlNDT1BFX09BVVRIX1RPS0VOX0xJU1QiLCJTQ09QRV9DT05UQUNUU19MSVNUIiwiU0NPUEVfT0FVVEhfVE9LRU5fUkVWT0tFIiwiU0NPUEVfRklMRV9ERUxFVEUiLCJTQ09QRV9GSUxFX0FERCIsIlNDT1BFX0ZPTERFUl9BREQiLCJTQ09QRV9BUElfVjFfQUNDRVNTIiwiU0NPUEVfQVBJQ0xJRU5UX0FERCIsIlNDT1BFX1NFTkRfSVRFTV9OT1RJRklDQVRJT04iLCJTQ09QRV9VU0VSSU5GT19FRElUX05PVElGWV9QUkVGIiwiU0NPUEVfREVWSUNFX0FVVEhFTlRJQ0FUSU9OIiwiU0NPUEVfQ09OVEFDVFNfVVBEQVRFIiwiU0NPUEVfRk9MREVSX0RFTEVURSIsIlNDT1BFX01PVkUiLCJTQ09QRV9PQVVUSF9UT0tFTl9MSVNUX0JZX0NMSUVOVCIsIlNDT1BFX1JFTU9WRV9TRUxGIiwiU0NPUEVfU0VMRl9SRVZPS0VfVE9LRU5TIiwiU0NPUEVfVklFVyIsIlNDT1BFX0NPTlNPTEVfQURNSU5fQUNDRVNTIiwiU0NPUEVfQVBJQ0xJRU5UX0xJU1QiLCJTQ09QRV9BRERSRVNTQk9PS19MSVNUIiwiU0NPUEVfU0hBUkUiLCJTQ09QRV9VU0VSSU5GT19VUERBVEUiLCJTQ09QRV9BQ0xfQURNSU4iLCJTQ09QRV9DT05UQUNUU19ERUxFVEUiLCJTQ09QRV9BUFBfQVBQUk9WQUxfUkVWT0tFIiwiU0NPUEVfUFJJTlQiLCJTQ09QRV9VU0VSSU5GT19HRVRfTk9USUZZX1BSRUYiLCJTQ09QRV9WSUVXX09USEVSIiwiU0NPUEVfUkVOQU1FIiwiU0NPUEVfQ09OVEFDVFNfQ1JFQVRFIiwiU0NPUEVfREVMRVRFX09USEVSIiwiU0NPUEVfQVBJX09BVVRIX0FDQ0VTUyIsIlNDT1BFX0RPV05MT0FEIiwiU0NPUEVfQVBQX0FQUFJPVkFMX0xJU1QiLCJTQ09QRV9VU0VSSU5GT19HRVRTRUxGIiwiU0NPUEVfQ09QWSJdfQ.XMEGyBnYEfy8dAPnJhchYlSJGreBRYGN1KbSF4DZoM6aegIPuSd-hES-nDH56ErrY-xLoMnrWYNeBKEE-Z1eJ6Y2qTnUexebWe7FMcqlVDRSKKQHw2pvcchRMuET3DibxwMZv-JwYcgb1npOWQL5ESRD38k-4kKoVfLfmStkm3kGuPsOr7db2kj6mQF8eMuvXjplzUMU2o42YdgBxLQ0jPcN-FM9yGxFJhWqZ_u6J45Fjlcc1SNYtgQZbwdd4IhfuBtLXqfeEVnNA7gRuNBwsEgBqx3G-i1xtu7ibt8i382JBO0gNmkxxPEK-E5tys-0EwOEv1i42_EYX7nBKd5i5A", "token_type": "bearer", "refresh_token": "75605643-a194-4bfc-a379-0d0154ab9783", "jti": "f1cd84ea-c6e8-4788-879b-13d34d44d526" } ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.