curl --request POST \
--url https://auth.occtoo.com/oauth2/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=client_credentials \
--data 'client_id=<client-id>' \
--data 'client_secret=<client-secret>' \
--data 'audience=<tenant-id>' \
--data scope=write:sources{
"access_token": "<access-token>",
"token_type": "Bearer",
"expires_in": 3600,
"scope": "write:sources"
}{
"error": "<string>",
"error_description": "<string>"
}{
"error": "<string>",
"error_description": "<string>"
}{
"error": "<string>",
"error_description": "<string>"
}Application authentication
Request an Application access token
Exchange Application or Data Provider credentials for a short-lived Occtoo access token.
POST
/
oauth2
/
token
curl --request POST \
--url https://auth.occtoo.com/oauth2/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=client_credentials \
--data 'client_id=<client-id>' \
--data 'client_secret=<client-secret>' \
--data 'audience=<tenant-id>' \
--data scope=write:sources{
"access_token": "<access-token>",
"token_type": "Bearer",
"expires_in": 3600,
"scope": "write:sources"
}{
"error": "<string>",
"error_description": "<string>"
}{
"error": "<string>",
"error_description": "<string>"
}{
"error": "<string>",
"error_description": "<string>"
}Use Try it to exchange an Application’s or Data Provider’s client credentials for a short-lived access token. The audience identifies the API the token targets, while the optional scope limits what the token can do.
Omit
Treat the client secret and returned access token as secrets. Use the playground only for direct testing. Do not copy either value into browser application code, source control, logs, or client-side configuration.
Choose an audience and scope
| Use case | Audience | Scope |
|---|---|---|
| Call a protected destination API version | API version ID | Leave empty |
| Ingest data | Tenant ID | write:sources |
| Legacy import or media ingest with a Data Provider | Tenant ID | import-datasource |
| Use every Events API transport | Tenant ID | read:events |
| Pull events and inspect metadata | Tenant ID | read:events:pull |
| Stream events with SSE | Tenant ID | read:events:sse |
| Manage sources and source properties | Tenant ID | read:sources, write:sources |
| Manage applications | Tenant ID | read:applications, write:applications |
| Manage managed tags | Tenant ID | read:cards, write:cards |
scope with the tenant audience to request every tenant API scope enabled for the Application.
Data Provider access token
For legacy import and media ingest, send aclient_credentials request to https://auth.occtoo.com/oauth2/token. Use the OAuth client ID and client secret for your Data Provider, your tenant ID as audience, and import-datasource as scope. Send the returned access_token as a bearer token to the Ingest API and reuse it until it expires.
See Applications for the complete access model, resource restrictions, language examples, and troubleshooting guidance.Body
application/x-www-form-urlencoded
OAuth grant used by machine-to-machine Applications and Data Providers.
Available options:
client_credentials OAuth client ID of the Application or Data Provider.
Example:
"<client-id>"
Client secret of the Application or Data Provider. Treat this value as a secret.
Example:
"<client-secret>"
Tenant ID for ingest and events, or API version ID for a protected destination API.
Example:
"<tenant-or-api-version-id>"
Optional space-delimited scopes. Use import-datasource for a Data Provider. Omit for destination access or to request every tenant scope granted to an Application.
Examples:
"write:sources"
"import-datasource"
"read:events"
"read:events:pull"
"read:events:sse"
Was this page helpful?