Skip to main content
POST
OneRoster 1.1 token endpoint (alias of /oauth/token)

Authorizations

Authorization
string
header
required

HTTP Basic authentication using your API client's client_id (username) and client_secret (password). Authenticates the token exchange only — never send it to any other endpoint.

Body

application/x-www-form-urlencoded
grant_type
enum<string>
required

The grant type must be client_credentials

Available options:
client_credentials
client_id
string

The client identifier (required if not provided in Authorization header)

client_secret
string

The client secret (required if not provided in Authorization header)

scope
string

The scope of the access request

Response

Token generated successfully

access_token
string
required

The access token

token_type
enum<string>
required

The token type

Available options:
bearer
expires_in
integer
required

Token expiration time in seconds

scope
string

The scope of the access token