Auth
Access tokens for server-to-server calls, and signing out.
Exchange client credentials for an access token
Exchanges client credentials for a short-lived access token, using the standard OAuth 2.0 client-credentials request and response shapes, so an off-the-shelf OAuth client works unchanged. Send the token as Authorization: Bearer <token> on later requests. A token is valid for one tenant, and revoking a credential takes effect immediately. Errors use this API's error shape rather than the OAuth error body, and validation failures here return 400 rather than 422.
Exchange client credentials for an access token › Request Body
grant_typeclient_idclient_secretExchange client credentials for an access token › Responses
A short-lived access token.
access_tokenAn opaque bearer token, sent on later requests as Authorization: Bearer <token>. It is a random value behind a fixed wer_token_ prefix, which exists so that a leaked token is recognisable to secret scanners — it carries no claims, so there is nothing to parse out of it and neither its length nor its alphabet is part of this contract. A token is valid for exactly one tenant, the one its credential belongs to.
token_typeexpires_inHow many seconds this token stays valid, counted from the moment it was issued. 900 under normal conditions, but read it rather than hard-coding it: a token is also cut short by its credential's own expiry, so the last token before a credential lapses comes back with a smaller number.
Exchanging again returns an additional token rather than replacing the one you hold, so a token already in flight keeps working. Revoking the credential, by contrast, takes effect immediately on every token issued from it.