> ## Documentation Index > Fetch the complete documentation index at: https://exsited.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Get an access token > Exchange your API credentials for the token every other call needs. Every call to the API needs an access token. Request one here with your API credentials, then send it as `Authorization: Bearer ACCESS_TOKEN`. The SDKs make this call for you, so you only need it for cURL, another HTTP client, or to try the API on this site. A token lasts `expires_in` seconds. **1. Enter your API host and credentials** Click **Try it**, set `host` to your Exsited API host name (without `https://`), choose `client_credentials` for `grant_type`, and fill in your client ID, client secret and redirect URI. **2. Send the request** The response holds `access_token`, `refresh_token` and `expires_in`. **3. Use the token** On any other endpoint, click **Try it**, set the same `host`, and paste the token into **Authorization**. > [!NOTE] > > A wrong client secret or redirect URI returns `400`. An unknown client ID, or a request without > `grant_type`, returns a redirect to the sign-in page instead of an error, and this page shows > `redirect to unsafe URL blocked`. The SDKs report both as an authentication error. Check the > client ID, client secret and redirect URI, and send again. > [!WARNING] > > A new token for the same credentials ends the previous one, so an app already running with those > credentials has to get a token again. Calls you make here run against your real data: creating, > changing and deleting records is real. Requests are sent through Mintlify's servers. Use test data, > and never share your credentials. ## OpenAPI ````yaml POST /oauth2/token openapi: 3.1.0 info: title: Exsited API version: v4 servers: - url: https://{host}/api/v4 variables: host: default: your-api-host.example.com description: Your Exsited API host name, without https://. security: - bearerAuth: [] tags: - name: Authentication - name: Accounts - name: Account emails - name: Account groups - name: Communications - name: Communication profiles - name: Orders - name: Quote orders - name: Express - name: Usages - name: Sales reps - name: Gift certificates - name: Invoices - name: Pro-forma invoices - name: Payments - name: Refunds - name: Credit notes - name: Credit note applications - name: Reconciliations - name: Items - name: Inventory adjustments - name: Units of measurement - name: Zones - name: Shipping packages - name: Shipping rules - name: Fulfillment profiles - name: Fulfillment terms - name: Item fulfillments - name: Item receipts - name: Bookings - name: Rental assets - name: Return merchandise authorisations - name: Purchase orders - name: Purchase invoices - name: Purchase payments - name: Purchase refunds - name: Purchase credit notes - name: Purchase credit note applications - name: Purchase express - name: Return vendor authorizations - name: ABA files - name: Receive terms - name: Labours - name: Tasks - name: Timesheets - name: Milestones - name: Employees - name: Departments - name: Designations - name: Teams - name: Time periods - name: Workflows - name: Workflow settings - name: Events - name: Custom events - name: System events - name: Approvals - name: Approval profiles - name: Approval user groups - name: Alerts - name: Alert responsibility settings - name: Alert responsibilities - name: Action scripts - name: Note groups - name: Note attachments - name: Instance settings - name: Accounting codes - name: Additional codes - name: Billing periods - name: Charging periods - name: Pricing periods - name: Invoice terms - name: Days of the month - name: Countries - name: Salutations - name: Document templates - name: Email templates - name: Roles - name: Operators - name: Operator groups - name: User settings - name: Custom attributes - name: Custom components - name: Custom features - name: Custom fields - name: Custom forms - name: Attribute attachments - name: Portal - name: Integration connections - name: External databases - name: Reports - name: Applications - name: Organisation - name: Child organisations - name: Webhooks paths: /oauth2/token: post: tags: - Authentication summary: Get an access token description: >- Exchanges your API credentials for an access token. Send the token as `Authorization: Bearer ACCESS_TOKEN` on every other call. The SDKs make this call for you and renew the token before it expires. operationId: get_access_token requestBody: required: true content: application/json: schema: type: object required: - grant_type - client_id - client_secret - redirect_uri properties: grant_type: type: string enum: - client_credentials - refresh_token description: >- `client_credentials` for a new token, or `refresh_token` to renew one. client_id: type: string description: Your integration's client ID. client_secret: type: string description: The secret paired with the client ID. redirect_uri: type: string description: >- The redirect URI registered for your integration. Required with `client_credentials`; not sent with `refresh_token`. refresh_token: type: string description: >- With `refresh_token` only: the `refresh_token` from an earlier token response. example: grant_type: client_credentials client_id: YOUR_CLIENT_ID client_secret: YOUR_CLIENT_SECRET redirect_uri: YOUR_REDIRECT_URI responses: '200': description: The access token. content: application/json: schema: type: object properties: access_token: type: string description: 'Send this as `Authorization: Bearer ACCESS_TOKEN`.' example: ACCESS_TOKEN expires_in: type: integer description: Seconds until the token expires, for example `3600`. example: 3600 refresh_token: type: string description: Exchanged for a new access token when this one expires. example: REFRESH_TOKEN '302': description: >- The client ID is not recognised, or `grant_type` is missing. The API redirects to its sign-in page instead of returning an error body, so this page shows `redirect to unsafe URL blocked`. '400': description: >- The client ID is recognised but the client secret or redirect URI is wrong, or `redirect_uri` is missing. content: application/json: schema: $ref: '#/components/schemas/Error' security: [] x-codeSamples: - lang: bash label: cURL source: |- curl -X POST "$EXSITED_BASE_URL/api/v4/oauth2/token" \ -H "Content-Type: application/json" \ -d '{ "grant_type": "client_credentials", "client_id": "YOUR_CLIENT_ID", "client_secret": "YOUR_CLIENT_SECRET", "redirect_uri": "YOUR_REDIRECT_URI" }' components: schemas: Error: type: object description: Every failed call returns this body. properties: object: type: string description: Always `error`. request_id: type: string description: Quote this to support. status: type: integer description: The HTTP status. code: type: string description: What went wrong, such as `validation_error`. message: type: string description: A short description of the problem. doc_url: type: string description: A link to more about this error. errors: type: array description: One entry per field that failed. items: type: object properties: field: type: string code: type: string message: type: string doc_url: type: string securitySchemes: bearerAuth: type: http scheme: bearer description: >- An access token from `POST /api/v4/oauth2/token`. The SDKs get and renew it for you. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.