> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withconvexity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate token

> Exchange a project API key for a short-lived OAuth 2.0 bearer token using the `client_credentials` grant. No `Authorization` header is required; supply the API key as `client_secret` in the request body.



## OpenAPI

````yaml POST /v1/oauth/token
openapi: 3.1.0
info:
  title: Convexity Infra API
  version: 1.0.0
  description: >-
    REST API reference for Convexity Infra: the backend services your business
    integrates to build and operate on-chain products. Every response is wrapped
    in a `{ status, message, data }` envelope and authorized with an OAuth 2.0
    bearer token minted by Auth-Edge.
  contact:
    name: Convexity Infra
    url: https://withconvexity.com
    email: infra@withconvexity.com
servers:
  - url: https://dev.api.withconvexity.com
    description: Development
security:
  - bearerAuth: []
tags:
  - name: Auth-Edge
    description: >-
      OAuth 2.0 token issuance. Exchange a project API key for a short-lived
      bearer token that authorizes every other Infra API call.
  - name: Projects
    description: >-
      Manage the calling project itself: rotate its API key pair and control
      which IP addresses may authenticate with it.
  - name: Payments
    description: >-
      List project and subscription payments, and mint virtual bank accounts
      (via KoraPay) for wallet top-ups and subscriptions.
  - name: Products
    description: >-
      Browse the products and capabilities available to your project. Each
      product maps to a plan and a set of capability keys.
  - name: Subscriptions
    description: List available plans and manage your project's subscriptions.
  - name: Wallet
    description: >-
      HD wallet lifecycle, balances, transfers, transaction signing, and
      supported-chain discovery. Wallets are scoped to the business in your
      token: accessing another business's wallet returns `403`.


      **Capabilities**: each operation is gated on a capability granted by your
      plan; a missing one returns `403: Missing required capability:
      <capability>`.


      | Capability | Grants |

      |---|---|

      | `wallet.hd.generate` | Generate wallets. |

      | `wallet.hd.read` | List and read wallets, counts, and HD status. |

      | `wallet.hd.sign` | Sign transactions. |

      | `wallet.hd.deactivate` | Deactivate a wallet. |

      | `wallet.transfer.create` | Initiate transfers. |

      | `wallet.transfer.read` | Read transaction history and records. |

      | `wallet.balance.read` | Read the USD balance. |
  - name: Indexer
    description: >-
      Subscribe to decoded on-chain events, receive signed webhooks, and inspect
      or replay delivery logs. Every endpoint requires a token with project +
      business context and a per-operation capability.
  - name: Tokenization
    description: >-
      Issue and manage tokenized real-world assets: create tokens, mint, burn,
      transfer, manage holders and registered wallets, and run yield operations
      (coupons, distributions, claims, and principal redemption).
paths:
  /v1/oauth/token:
    post:
      tags:
        - Auth-Edge
      summary: Generate token
      description: >-
        Exchange a project API key for a short-lived OAuth 2.0 bearer token
        using the `client_credentials` grant. No `Authorization` header is
        required; supply the API key as `client_secret` in the request body.
      operationId: generateToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - grant_type
                - client_secret
              properties:
                grant_type:
                  type: string
                  enum:
                    - client_credentials
                  description: Must be `client_credentials`.
                client_secret:
                  type: string
                  description: Project API key.
                scope:
                  type: string
                  description: >-
                    Space-separated scopes (max 500 chars). Omit for full
                    access.
            example:
              grant_type: client_credentials
              client_secret: '{{clientSecret}}'
              scope: ''
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
              example:
                access_token: ''
                token_type: Bearer
                expires_in: 600
                scope: payments:read
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_request
                error_description: Invalid literal value, expected "client_credentials"
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
              example:
                error: invalid_client
                error_description: >-
                  Missing API key. Use HTTP Basic auth or supply client_secret
                  in the body.
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
              example:
                error: unauthorized_client
                error_description: >-
                  This API key is not permitted to request the 'payments'
                  audience
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: object
              example:
                status: false
                message: Too many requests. Please try again later.
                retryAfter: 42
        '500':
          description: Response
          content:
            application/json:
              schema:
                type: object
              example:
                error: server_error
                error_description: An unexpected error occurred
        '503':
          description: Service unavailable
          content:
            application/json:
              schema:
                type: object
              example:
                error: temporarily_unavailable
                error_description: >-
                  The authorization server is temporarily unable to handle the
                  request
      security:
        - {}
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token from Auth-Edge.

````