Authentication API reference - get m2m token

Get Access Token

POSThttps://test.stytch.com/v1/public/{project_id}/oauth2/token

Retrieve an access token for the given M2M Client. Access tokens are JWTs signed with the project's JWKS , and are valid for one hour after issuance. M2M Access tokens contain a standard set of claims as well as any custom claims generated from templates.

M2M Access tokens can be validated locally using the Authenticate Access Token method in the Stytch Backend SDKs, or with any library that supports JWT signature validation.

Here is an example of a standard set of claims from a M2M Access Token:

{
  "sub": "m2m-client-test-d731954d-dab3-4a2b-bdee-07f3ad1be885",
  "iss": "stytch.com/PROJECT_ID",
  "aud": ["PROJECT_ID"],
  "scope": "read:users write:users",
  "iat": 4102473300,
  "nbf": 4102473300,
  "exp": 4102476900
}

Important: Unlike other Stytch API endpoints, this endpoint is not authenticated with a project_id and project_secret pair. Instead, it is authenticated via the client_id and client_secret of an active M2M Client within the current project.

This endpoint is a RFC-6749 compliant token issuing endpoint.

This endpoint supports passing the client_id and client_secret within the request body as well as within a HTTP-Basic Auth header.
This endpoint supports both application/json and application/x-www-form-urlencoded content types.

Path parameters

project_id* string

Body parameters

client_id* string

client_secret* string

scope string

grant_type* string

Response fields

status_code int

request_id string

access_token string

token_type string

expires_in number

curl --request POST \
	--url https://test.stytch.com/v1/public/PROJECT_ID/oauth2/token \
	-H 'Content-Type: application/json' \
	-d '{
		"client_id": "m2m-client-test-d731954d-dab3-4a2b-bdee-07f3ad1be885",
		"client_secret": "NHQhc7ZqsXJVtgmN2MXr1etqsQrGAwJ-iBWNLKY7DzJj",
		"grant_type": "client_credentials"
	}'

RESPONSE

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "access_token": "eyJ...",
    "token_type": "bearer",
    "expires_in": 3600
}