# Get oauth2 token

Get oauth2 token using the client credentials.

Endpoint: POST /v2/auth/oauth2-token
Version: v2

## Request fields (application/x-www-form-urlencoded):

  - `grant_type` (string, required)
    Supported values are client_credentials and urn:ietf:params:oauth:grant-type:token-exchange.

  - `client_id` (string, required)
    Identifier for the API user.

  - `client_secret` (string, required)
    Password

  - `audience` (string)
    Identifies the API being accessed in Spotnana.
    Example: "https://apis.spotnana.com/v2"

  - `subject_token` (string)
    A security token that represents the identity of the entity on whose behalf the request 
is being made.

  - `subject_token_type` (string)
    Indicates the type of the subject_token used for token exchange. 
This field supports the valid types as per the OAUTH 2.0 security framework.

  - `scope` (string)
    The list of space-delimited, case-sensitive strings, as defined in Section 3.3 of 
RFC6749 OAuth 2.0 framework, that allow the client to specify the desired scope of the requested security 
token in the context of the service or resource where the token will be used.

## Response 200 fields (application/json):

  - `access_token` (string, required)
    The token to be used in subsequent API calls made to the Spotnana platform.

  - `expires_in` (integer)
    The length of time (in seconds) for which the access token is valid.

  - `token_type` (string, required)
    A case-insensitive value specifying the method of using the access token issued, as 
specified in Section 7.1 of [RFC6749].
    Example: "Bearer"

  - `refresh_token` (string)
    Used to fetch a new access token when the existing token expires.
The refresh token will not be available if the grant_type is client_credentials.

  - `scope` (string)
    The list of space-delimited, case-sensitive strings, as defined in Section 3.3 of 
[RFC6749], that allow the client to specify the desired scope of the requested security 
token in the context of the service or resource where the token will be used.

## Response 403 fields (application/json):

  - `debugIdentifier` (string)
    Link to debug the error internally.

  - `errorMessages` (array)

  - `errorMessages.errorCode` (string)
    Error code to identify the specific errors.

  - `errorMessages.message` (string)
    Message containing details of error.

  - `errorMessages.errorParameters` (array)
    Error message parameters.

  - `errorMessages.errorParameters.name` (string)
    Parameter name

  - `errorMessages.errorParameters.value` (string)
    Parameter value

  - `errorMessages.errorDetail` (string)
    More details about the error.