> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siro.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a client app access token

> OAuth 2.0 `client_credentials` grant.

Use the returned `access_token` as `Authorization: Bearer` on the org-wide API (`functions.siro.ai`) and as `x-siro-auth-token` on the user-scoped API (`api.siro.ai`). See [Authentication](/authentication).



## OpenAPI

````yaml specs/openapi-auth.json post /oauth2/token
openapi: 3.0.3
info:
  title: Siro Auth
  version: 1.0.0
  description: >-
    OAuth 2.0 token endpoint for client apps (`client_credentials`). This spec
    is maintained in this repo; it is not fetched from a backend swagger URL.
servers:
  - url: https://auth.siro.ai
    description: Siro auth (Cognito)
security: []
paths:
  /oauth2/token:
    post:
      summary: Get a client app access token
      description: >-
        OAuth 2.0 `client_credentials` grant.


        Use the returned `access_token` as `Authorization: Bearer` on the
        org-wide API (`functions.siro.ai`) and as `x-siro-auth-token` on the
        user-scoped API (`api.siro.ai`). See [Authentication](/authentication).
      operationId: getClientAppAccessToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
                - client_id
                - client_secret
              properties:
                grant_type:
                  type: string
                  description: Always `client_credentials`.
                  enum:
                    - client_credentials
                  default: client_credentials
                client_id:
                  type: string
                  description: Client app id from the Siro web app.
                client_secret:
                  type: string
                  description: Client app secret from the Siro web app.
      responses:
        '200':
          description: Access token issued
          content:
            application/json:
              schema:
                type: object
                required:
                  - access_token
                  - token_type
                  - expires_in
                properties:
                  access_token:
                    type: string
                    description: >-
                      Access token. Send as `Authorization: Bearer` on the
                      org-wide API, or as `x-siro-auth-token` on the user-scoped
                      API.
                  token_type:
                    type: string
                    description: Always `bearer`.
                    enum:
                      - bearer
                  expires_in:
                    type: integer
                    description: >-
                      Seconds until the token expires. Typically `3600`. There
                      is no refresh token — mint a new access token before
                      expiry.
                    example: 3600
              example:
                access_token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
                token_type: bearer
                expires_in: 3600
      security: []

````