Request access token

Return an OAuth 2.0 bearer token for an API service account.

Tokens are issued using the client credentials grant, which authenticates your service account rather than an individual user.

Request a token

post

Exchange your Base64-encoded service account credentials for an OAuth2 access token.

Header parameters

AuthorizationstringRequired

Enter Basic, a space, and your Base64-encoded ClientID:ClientSecret (the only value you need to edit).

Default: Basic <Base64Encoded(ClientID:ClientSecret)>

Body

grant_typestringRequired

The OAuth2 grant type. Always client_credentials, because your service account authenticates as itself rather than on behalf of a user.

scopestringRequired

The scope of the access token. Always api/api.

Responses

200

An access token was issued.

application/json

access_tokenstringRequired

The bearer token to send on every API request.

token_typestringRequired

The type of token issued.

Example: Bearer

expires_inintegerRequired

The lifetime of the token in seconds. Tokens are issued with a lifetime of one hour.

Example: 3600

400

The request was rejected. invalid_client means the credentials in the Authorization header were not accepted.

application/json

post/oauth2/token

POST /oauth2/token HTTP/1.1
Host: eseye-idp-prod.auth.eu-west-1.amazoncognito.com
Authorization: Basic <Base64Encoded(ClientID:ClientSecret)>
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 53

"grant_type='client_credentials'&scope='api/api'"

{
  "access_token": "eyJraWQiOiJhYmMxMjMiLCJhbGciOiJSUzI1NiJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Returns an OAuth 2.0 bearer token for an API service account.

POST /oauth2/token

Endpoint

https://eseye-idp-prod.auth.<region>.amazoncognito.com/oauth2/token

Replace <region> with the AWS region Eseye provided.

Request headers

Header	Value	Required
Authorization	Basic <credentials>	Yes
Content-Type	application/x-www-form-urlencoded	Yes

<credentials> is the Base64-encoded form of <client-id>:<client-secret>.

Form parameters

Parameter	Value	Required	Description
grant_type	client_credentials	Yes	Authenticates the service account.
scope	api/api	Yes	Requests Eseye API access.

Example request

curl --request POST \
  --url "https://eseye-idp-prod.auth.eu-west-1.amazoncognito.com/oauth2/token" \
  --user "${ESEYE_CLIENT_ID}:${ESEYE_CLIENT_SECRET}" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=api/api"

Successful response

An accepted request returns HTTP 200:

{
  "access_token": "eyJraWQiOiJhYmMxMjMiLCJhbGciOiJSUzI1NiJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Reuse the token until it expires, then request another token.

Error response

The endpoint returns HTTP 400 when it rejects a request. An invalid_client error means the credentials were not accepted.