Skip to content

Access Token

Request

Exchange an API ID and API key for an OAuth2 bearer token.

  • Preconditions: client_id is the API ID and client_secret the API key. The member must be active, and the caller's IP must satisfy the Open API IP allow and deny lists.
  • Effect: none — the token is self-signed and nothing is stored server side.
  • Lifetime: expires_in seconds, 3600 by default. There is no refresh token and no refresh endpoint; request a new token instead.
  • Concurrency: because tokens are stateless, issuing a new one does not invalidate earlier tokens — several can be valid at once. A token stops working only when it expires or when the API key is rotated.
  • Retry: safe to retry.

Documented business errors: 12002, 35002, 35005. See Error Codes for what each code means. Any operation can additionally return the common codes.

Headers
Content-Typestringrequired
Example:application/json
Bodyapplication/json
client_idstringrequired

A API ID identifies an member

client_secretstringrequired

A API Key authenticates a client ID. To call MoreLogin APIs, you'll exchange your API ID and API Key for an access token. Keep this secret safe.

grant_typestringrequired

Package name — required only if appVersionId is not provided

Example:"client_credentials"
curl -i -X POST \
  https://api.morelogin.com/oauth2/token \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "1661515884160372",
    "client_secret": "string",
    "grant_type": "client_credentials"
  }'

Responses

Success. data is an object with the fields scope, access_token, token_type, expires_in and client_metadata.

Headers
any
Bodyapplication/json
codeintegerrequired
msgstring or nullrequired
dataobjectrequired
requestIdstringrequired
Response
{ "code": 0, "msg": null, "data": { "scope": "cloudphone", "access_token": "example-access-token\n", "token_type": "Bearer", "expires_in": 3600, "client_metadata": {} }, "requestId": "1d4f3ea968664593860b94b35d4ebf5e" }