client_credentials grant, then send that token on each subsequent request. See
Authentication for the full flow.
The access token object
Returned by Generate token.| Attribute | Type | Description |
|---|---|---|
access_token | string | Signed JWT to send as Authorization: Bearer <access_token>. |
token_type | string | Always Bearer. |
expires_in | integer | Token lifetime in seconds (e.g. 600 = 10 minutes). |
scope | string | Granted scope. Omitted for unscoped, full-access tokens. |
businessId, keyId, the environment (live / test), the
granted scope, and an aud (audience). Downstream services read these claims to
enforce project context and capabilities — you never send them yourself.
Tokens are short-lived. Mint a new one when the current token expires rather than
caching a long-lived credential. The token endpoint is rate-limited to 30 requests
per minute per IP.