> ## Documentation Index
> Fetch the complete documentation index at: https://botsify.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth Token — Exchange Credentials for a Bearer Token

> Exchange Botsify credentials for an OAuth2 Bearer token using the password grant flow. Use client_id and client_secret from login.

Exchange your Botsify credentials for a short-lived OAuth 2.0 Bearer token using the `password` grant flow. You must first call the [Login](/api-reference/authorization/login) endpoint to obtain the `client_id` and `client_secret` required here. Include the returned `access_token` in the `Authorization: Bearer` header of every subsequent API request.

## Request

<ParamField body="grant_type" type="string" required>
  The OAuth 2.0 grant type. Must be `"password"`.
</ParamField>

<ParamField body="client_id" type="string" required>
  Your OAuth client ID, returned by the `/api/v1/login` endpoint.
</ParamField>

<ParamField body="client_secret" type="string" required>
  Your OAuth client secret, returned by the `/api/v1/login` endpoint.
</ParamField>

<ParamField body="username" type="string" required>
  Your Botsify account email address.
</ParamField>

<ParamField body="password" type="string" required>
  Your Botsify account password.
</ParamField>

<ParamField body="scope" type="string" required>
  The requested OAuth scope. Pass an empty string (`""`) to request the default scope.
</ParamField>

## Example

```bash theme={null}
curl --request POST \
  --url https://app.botsify.com/oauth/token \
  --header 'Content-Type: application/json' \
  --data '{
    "grant_type": "password",
    "client_id": "<FROM_LOGIN_API>",
    "client_secret": "<FROM_LOGIN_API>",
    "username": "you@example.com",
    "password": "yourpassword",
    "scope": ""
  }'
```

## Response

A successful `200 OK` response returns a standard OAuth 2.0 token object.

| Field | Type | Description |
| - | - | - |
| `access_token` | string | The Bearer token to include in the `Authorization` header of API requests. |
| `token_type` | string | Always `"Bearer"`. |
| `expires_in` | integer | Lifetime of the token in seconds. |
| `refresh_token` | string | Token used to obtain a new `access_token` without re-authenticating. |

```json theme={null}
{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGci...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "refresh_token": "def50200abc..."
}
```

<Note>
  Use the `access_token` as `Authorization: Bearer <access_token>` on all protected endpoints. When the token expires, repeat this request or use the `refresh_token` to obtain a new one.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.