---
title: 4. Get an Access Token
slug: guides/4-get-an-access-token
docTags: 
createdAt: 2024-04-12T14:21:15.855Z
---

:::hint{type="info"}
🌟 **Key Concept: **An [Access Token](docId\:J0pcQhmmKqIGZBCkmNiu9) is a credential granted by the Authorization Server that allows Client applications to access protected Resources from a Resource Server. 
:::

**This example setup shows how Clients can request, get, and use an Access Token from the IDENTOS Authorization Server.**

`TODO: Add overview diagram with step emphasized.`

This setup will... *TODO: Introduce example.*

## Prerequisites

- You've created the example Resource Server from [1. Create a Basic Resource Server](docId:43VMG-opG9QS9umQ0_J8t)
- You've created the example Resource from [2. Create a Basic Resource](docId\:ba8INrCxEGve9Zyr7gJUh)
- You've created the example Client from [3. Create a Basic Client](docId\:pMynCndy11XUp3aFhp7-8)

## Step-by-Step Setup

**To get an Access Token from the Authorization Server, we'll need to...**

1. **Request an Access Token **from the Authorization Server.
2. **Get an Access Token **from the Authorization Server's response.

Since we've already authorized our Client to access the `blood-glucose-level` Resource type, it doesn't need additional consent or authorization from an end user. As a result, all the Client has to do is request an Access Token from the Authorization Server, as outlined below.

::::WorkflowBlock
:::WorkflowBlockItem
### Request an Access Token

Run the API call below to request an Access Token with the `read` scope from the Authorization Server.

```shell
curl -X POST --location '{{AS_ADMIN_URI}}/oauth2/token' \
-H 'Content-type: application/json' \
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \
-d '{
    "grant_type": "client_credentials",
    "scope" : "alec laws" #read?
}'

# No need for client authentication?
grant_type=client_credentials
&client_id=xxxxxxxxxx
&client_secret=xxxxxxxxxx
```
:::

:::WorkflowBlockItem
### Get an Access Token

A successful response from the Authorization Server will include the Access Token in the `access_token` property, as well as other details such as when the Access Token expires (`expires_in`) and what the available scopes are (`scope`).

```curl
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwOlwvXC9sb2NhbGhvc3Q6ODA4NiIsInN1YiI6IkJ1Y1IzaGNnNDNRWUhObjYxN2psUEtUZW1IS0J4aFg1dnpxZmx5MG9PSkNFVkIzWEl1NmNycVRReUFpR3RWMWIiLCJyZXNvdXJjZV9vd25lciI6IjBhNDhmNTA5LWY0MjgtNDZjNi04ZWI5LTRkOTYwOWMwMTZmYiIsImlzcyI6Imh0dHA6XC9cL2xvY2FsaG9zdDo4MDg0IiwicmVzb3VyY2VfaWQiOiJvcGVuaWQiLCJncmFudGVkX3Njb3BlcyI6WyJyZWFkIl0sInR5cGUiOiJwZXJtaXNzaW9uIiwiZXhwIjoxNjU4MjMwNzMzLCJjbGllbnRfaWQiOiJvYXV0aF91bWFfY2xpZW50In0.FHWGOTFg0K06L1VhNasc-pKZ8OLCUB7clUbjwdSSIHs",
  "expires_in": 3599,
  "token_type": "Bearer",
  "refresh_token": "e0dd0169-36a9-4cf4-b30a-3b78c6162bc3",
  "scope": "read"
}
```
:::

:::WorkflowBlockItem
### Use the Access Token (Optional)

TBD (create example API call using access token for auth)

```curl
TBD
```
:::
::::

:::hint{type="success"}
## Next Steps

**✅ You just got a basic Access Token from the Authorization Server! **

- **Next step: **Proceed to [5. Enable Consent Management](docId\:EGg-Ifn07IGbQRZOuZGwN) to learn how to add user consent to the authorization flow you just created.
- **Learn more: **Read the [Get an Access Token](docId\:K03h8eFr3UGJWXBxdOSmH) guide to learn more about getting Access Tokens from the Authorization Server.
:::

# Simple OAuth client w/ client\_credntials grant\_type

INSERT INTO oauth\_client (id, version, date\_created, last\_updated, client\_id, client\_name, oauth\_client\_oauth\_client\_metadata\_id)
VALUES
    (4, 0, '2024-04-12 01:03:36', '2024-04-12 01:03:36', 'fpxsp', 'FPX Service Provider', 4);
    
INSERT INTO oauth\_client\_metadata (id, version, date\_created, last\_updated, issuer\_uri, client\_authentication\_type, client\_type, grant\_types, jwks\_raw, jwks\_uri, meta\_data\_raw, allowed\_scopes, client\_secret)
VALUES
    (4, 0, '2024-04-12 01:03:36.321000', '2024-04-12 01:03:36.321000', 'https\://fpxsp.dev.identos.ca', 'client\_secret\_basic', 'CONFIDENTIAL', 'client\_credentials', NULL, NULL, NULL, 'uma\_protection alec laws', 'secret');

INSERT INTO oauth\_client\_redirect\_uris (OAuthClient\_id, redirect\_uris)
VALUES
    (4, 'https\://fpxsp.dev.identos.ca');


curl -X POST --location http\://localhost:8081/oauth2/token \\
-H 'Content-type: application/json' \\
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \\
-d '\{
    "grant\_type": "client\_credentials",
    "scope" : "alec uma\_protection"
}'


curl -X POST --location http\://localhost:8081/oauth2/token \\
-H 'Content-type: application/json' \\
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \\
-d '\{
    "grant\_type": "client\_credentials",
    "scope" : "alec laws"
}'
\{"access\_token":"eyJraWQiOiJyc2ExIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJmcHhzcCIsInNjb3BlIjoiYWxlYyBsYXdzIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxIiwiZXhwIjoxNzEyOTM0OTkyLCJpYXQiOjE3MTI5MzEzOTIsImp0aSI6ImJhYTg5MzIxLWJmMTUtNDUyOS1hODNlLTk3M2MxZWU2OGRiMyJ9.NQAL8cAs6rIVNdRj2gUSAeN-J4GRjIS23V\_nNE8bccapRJq5jY4Xjm7Z-7bXA9ElURilbfC-32df\_qRDqAgnO6kh9WHXuPXzo1BzSzx7NcndFnPTk\_IyobEQeKdKDliXTnLq98z4In\_UqJ-uWd7lz-HfPvoxov6nWHS0F6AeqhZO0P05Xb6gImeCZF\_jP8iLzAjEFhYQ8ilQ11WpQ6ji1rXfvITriLyRp252EP2vYicX7--Ls9Kk\_FSWJ2-dxp2F-iIcQwwy70dtodUmhFc5lmfi-5FevwNG6gqnjD79ktiZv6JtdHBSK-LoGlSrKyYje-lN8qghACVwhj5L4aI1Yw","expires\_in":3599,"token\_type":"Bearer","scope":"alec laws"}%

curl -X POST --location http\://localhost:8081/oauth2/token \\
-H 'Content-type: application/json' \\
-H 'Authorization: Basic ZnB4c3A6c2VjcmV0'  \\
-d '\{
    "grant\_type": "client\_credentials",
    "scope" : "alec not\_my\_scope"
}'

->> error invalid scope