> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication API

> The Authentication API provides endpoints for obtaining Personal API Access Tokens, which are required for accessing all other Management API endpoints.

## Overview

The Authentication API provides endpoints for obtaining Personal API Access Tokens, which are required for accessing all other Management API endpoints.

## Authentication

The token creation endpoint does not require authentication. However, you must provide valid Apinizer credentials (username and password) to obtain a token.

## Token Usage

Once you have obtained a token, include it in the `Authorization` header of all subsequent API requests:

```
Authorization: Bearer YOUR_TOKEN
```

## Create Token

### Endpoint

```
POST /apiops/auth/token
```

### Request

#### Headers

| Header       | Value                             | Required |
| ------------ | --------------------------------- | -------- |
| Content-Type | application/x-www-form-urlencoded | Yes      |
| Accept       | application/json                  | No       |

#### Request Body (URL Encoded)

The request body must be sent as `application/x-www-form-urlencoded` (not JSON).

| Parameter      | Type   | Required | Description                  |
| -------------- | ------ | -------- | ---------------------------- |
| grant\_type    | string | Yes      | Must be `client_credentials` |
| client\_id     | string | Yes      | Your Apinizer username       |
| client\_secret | string | Yes      | Your Apinizer password       |

#### Full Request Body Example

```
grant_type=client_credentials&client_id=your_username&client_secret=your_password
```

### Response

#### Success Response (200 OK)

```json theme={null}
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

##### Response Fields

| Field         | Type    | Description                                             |
| ------------- | ------- | ------------------------------------------------------- |
| access\_token | string  | The Personal API Access Token to use for authentication |
| token\_type   | string  | Always `Bearer`                                         |
| expires\_in   | integer | Token expiration time in seconds (if applicable)        |

#### Error Response (400 Bad Request)

```json theme={null}
{
  "error": "unsupported_grant_type",
  "error_description": "GrantType value must be client_credentials!"
}
```

**Cause:** The `grant_type` parameter is not `client_credentials`.

#### Error Response (401 Unauthorized)

```json theme={null}
{
  "error": "unauthorized_client",
  "error_description": "Bad credentials"
}
```

##### Causes

* Invalid username or password
* Account is disabled or locked
* Credentials are incorrect

#### Error Response (500 Internal Server Error)

```json theme={null}
{
  "error": "server_error",
  "error_description": "An unexpected error occurred"
}
```

### cURL Example

```bash theme={null}
curl -X POST \
  "https://demo.apinizer.com/apiops/auth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Accept: application/json" \
  -d "grant_type=client_credentials&client_id=your_username&client_secret=your_password"
```

### Full JSON Body Example

<Note>
  This endpoint uses `application/x-www-form-urlencoded` format, not JSON. The example below shows the equivalent data structure:
</Note>

```json theme={null}
{
  "grant_type": "client_credentials",
  "client_id": "your_username",
  "client_secret": "your_password"
}
```

**Important:** When making the actual request, send this data as URL-encoded form data, not as JSON.

## Notes and Warnings

* **Security**: Never commit credentials or tokens to version control
* **Token Storage**: Store tokens securely (use environment variables or secret management)
* **Token Expiration**: Tokens may expire based on configuration. Check `expires_in` field
* **Token Format**: Always use `Bearer` prefix when including token in Authorization header
* **Content-Type**: This endpoint requires `application/x-www-form-urlencoded`, not `application/json`

## Related Documentation

* [Authentication Guide](/api-reference/getting-started/authentication) - Detailed authentication information
* [Error Handling](/api-reference/getting-started/error-handling) - Error response formats