Get access token

​

Issues a short-lived access token.

All API requests require a Bearer token obtained via the Client Credentials grant. Use your Client ID and Client Secret to request a token from Cognito, then pass the token in the Authorization header on every request.

This endpoint lives on the authorization host, not on the transaction host:

  • Sandbox: https://test-auth.kortapi.com/oauth2
  • Production: https://auth.kortapi.com/oauth2

Using the access token

Include the token on all API calls:

Authorization: Bearer {BEARER_TOKEN}

Token lifetime and expiration

  • expires_in — Number of seconds the token is valid (default 3600s).
  • Tokens are stateless JWTs validated by Cognito JWKS.
  • No refresh token is issued for client credentials.
  • When the token expires, call /token again to obtain a new one.

Best practices

  • Request a new token when you receive 401 Unauthorized with invalid_token.
  • Do not cache tokens beyond their expires_in.
  • Use least-privileged scopes where supported.

Security notes

  • Keep client_id and client_secret secret (do not embed in browsers or mobile apps).
  • Use HTTPS only.
  • Rotate credentials periodically and revoke if compromised.

Body

required
application/json

Responses

  • application/json
  • application/json
  • application/json
  • 429

    Rate limited.

  • 5XX

    Server error.

Request Example for post/token
curl https://test-auth.kortapi.com/oauth2/token \
  --request POST \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'client_id={CLIENT_ID}' \
  --data-urlencode 'client_secret={CLIENT_SECRET}' \
  --data-urlencode 'grant_type=client_credentials'

{
  "access_token": "{BEARER_TOKEN}",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Token issued.

Previous
Authorization
Next
Payin