---
title: "Get an OAuth2 access token"
description: "Exchange CloudPrint API credentials for a short-lived OAuth2 Bearer token using the Client Credentials grant."
---
<nav class="docs-breadcrumb" aria-label="Breadcrumb"><a href="/docs/">CloudPrint Documentation</a><span aria-hidden="true">/</span><span>API reference</span></nav>

# Get an OAuth2 access token

<p class="docs-lead">Exchange CloudPrint API credentials for a short-lived OAuth2 Bearer token using the Client Credentials grant.</p>

<div class="api-endpoint-summary"><span class="api-method api-method-post">POST</span><code>/oauth/token</code><span><strong>API version:</strong> v1</span><span><strong>operationId:</strong> <code>issueOAuthToken</code></span><a href="/docs/api/v1/authentication/token/index.md">View as Markdown</a></div>

## What this endpoint does

Exchange CloudPrint API credentials for a short-lived OAuth2 Bearer token using the Client Credentials grant.

## Authentication

This endpoint does not require a Bearer token.

## Request

**Production base URL:** `https://public-api.cloudprint.me/oauth/token`

### Parameters

This endpoint has no path, query or custom header parameters.

### Request body

**Content type:** `application/x-www-form-urlencoded`

| Name | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| `grant_type` | `string` | yes | OAuth2 grant used for the token request. | enum: `client_credentials`; example: `"client_credentials"` |
| `client_id` | `string` | yes | Public identifier from the account API Credentials pair. | — |
| `client_secret` | `string` | yes | Secret from API Credentials; keep it only in a backend secret store. | — |
| `scope` | `string` | no | Space-separated scopes requested for the access token. | example: `"agents:read printers:read documents:write print_jobs:write print_jobs:read"` |

### Example requests

#### cURL

```bash
curl -sS https://public-api.cloudprint.me/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=33333333-3333-4333-8333-333333333333' \
  --data-urlencode 'client_secret=cpsec_...' \
  --data-urlencode 'scope=agents:read printers:read documents:write print_jobs:write print_jobs:read'
```

#### PHP

```php
<?php

$response = file_get_contents('https://public-api.cloudprint.me/oauth/token', false, stream_context_create([
    'http' => [
        'method' => 'POST',
        'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
        'content' => http_build_query([
            'grant_type' => 'client_credentials',
            'client_id' => getenv('CLOUDPRINT_CLIENT_ID'),
            'client_secret' => getenv('CLOUDPRINT_CLIENT_SECRET'),
            'scope' => 'agents:read printers:read documents:write print_jobs:write print_jobs:read',
        ]),
    ],
]));

$token = json_decode((string) $response, true, flags: JSON_THROW_ON_ERROR)['access_token'];
```

## Response

**HTTP status:** `200` — Access token issued

### Response fields

| Name | Type | Required | Description | Constraints |
| --- | --- | --- | --- | --- |
| `token_type` | `string` | yes | OAuth2 token type; Public API tokens use `Bearer`. | example: `"Bearer"` |
| `expires_in` | `integer` | yes | Access-token lifetime in seconds from the time of issuance. | example: `900` |
| `access_token` | `string` | yes | Short-lived OAuth2 Bearer token used in Public API requests. | example: `"eyJ..."` |
| `scope` | `string` | yes | Space-separated scopes requested for the access token. | example: `"printers:read print_jobs:write"` |

### Example response

```json
{
  "token_type": "Bearer",
  "expires_in": 900,
  "access_token": "eyJ...",
  "scope": "printers:read print_jobs:write"
}
```

## Errors

| HTTP status | Description |
| --- | --- |
| `400` | Invalid OAuth2 request |
| `401` | Invalid OAuth2 client credentials |
| `429` | Rate limit exceeded |
| `500` | OAuth2 server error |

## Integration guidance

- Keep `client_secret` only in a backend secret store; never send it to browser or distributed desktop code.
- Cache the token until shortly before `expires_in` instead of requesting a token for every print job.
- Request the smallest scope set needed by the current integration.

## Related documentation

<div class="docs-card-grid"><a class="docs-card" href="/docs/api/v1/authentication/client-context/"><strong>Get the current API client context</strong><span>Confirm which CloudPrint account, client application and scopes are represented by the current access token.</span></a>
<a class="docs-card" href="/docs/api/authentication/"><strong>Authenticate with OAuth2 Client Credentials</strong><span>Create a CloudPrint client app, request a short-lived access token and protect credentials with the correct API scopes.</span></a>
<a class="docs-card" href="/docs/api/v1/errors/"><strong>CloudPrint API errors and retries</strong><span>Handle CloudPrint API status codes, machine-readable errors, rate limits, request tracing and safe retry decisions.</span></a></div>

<nav class="docs-resource-links" aria-label="Next steps"><a href="/docs/api/v1/explorer/">OpenAPI</a><a href="https://my.cloudprint.me">Open account</a><a href="/docs/legal/privacy/">Privacy Policy</a><a href="/docs/legal/terms/">Terms</a><a href="/docs/legal/payments-and-refunds/">Payment and refunds</a><a href="/docs/legal/data-processing/">DPA</a></nav>