Exchange an API ID and API key for an OAuth2 bearer token.
- Preconditions:
client_idis the API ID andclient_secretthe API key. The member must be active, and the caller's IP must satisfy the Open API IP allow and deny lists. - Effect: none — the token is self-signed and nothing is stored server side.
- Lifetime:
expires_inseconds, 3600 by default. There is no refresh token and no refresh endpoint; request a new token instead. - Concurrency: because tokens are stateless, issuing a new one does not invalidate earlier tokens — several can be valid at once. A token stops working only when it expires or when the API key is rotated.
- Retry: safe to retry.
Documented business errors: 12002, 35002, 35005. See Error Codes for what each code means. Any operation can additionally return the common codes.
A API Key authenticates a client ID. To call MoreLogin APIs, you'll exchange your API ID and API Key for an access token. Keep this secret safe.
POST
curl -i -X POST \
https://api.morelogin.com/oauth2/token \
-H 'Content-Type: application/json' \
-d '{
"client_id": "1661515884160372",
"client_secret": "string",
"grant_type": "client_credentials"
}'Response
{ "code": 0, "msg": null, "data": { "scope": "cloudphone", "access_token": "example-access-token\n", "token_type": "Bearer", "expires_in": 3600, "client_metadata": { … } }, "requestId": "1d4f3ea968664593860b94b35d4ebf5e" }