# Obtain access token

Issues a short-lived bearer token using OAuth 2.0 Client Credentials. Send grant_type=client_credentials with your client_id and client_secret (optionally scope, state). Use the returned access_token in the Authorization: Bearer header on subsequent requests. The response also includes expires_in (seconds) and echoes state when provided.

Endpoint: POST /v2/partner/auth/token
Version: 2.0.0

## Request fields (application/x-www-form-urlencoded):

  - `grant_type` (string, required)
    Enum: "client_credentials"

  - `client_id` (string, required)
    The Client ID provided by Fondo

  - `client_secret` (string, required)
    The Client Secret provided by Fondo

  - `scope` (string)
    Comma separated list of scopes.
    Example: "`account:read, account:write`\n"

  - `state` (string)
    Client state. For example a base64 encoded string of state data.
    Example: "VGhpcyBpcyBteSBzdGF0ZS4gVGhlcmUgYXJlIG1hbnkgbGlrZSBpdCwgYnV0IHRoaXMgaXMgb25lIG1pbmUu"

## Response 200 fields (application/json):

  - `access_token` (string, required)
    access_token to use for subsequent requests
    Example: "ffe74ba1-99a8-46e3-9ba2-9c0ef72e13c1"

  - `expires_in` (number, required)
    The lifetime in seconds of the access token. Default is 432000 (5 days)
    Example: 432000

  - `state` (string)
    Client state. For example a base64 encoded string of state data.
    Example: "VGhpcyBpcyBteSBzdGF0ZS4gVGhlcmUgYXJlIG1hbnkgbGlrZSBpdCwgYnV0IHRoaXMgaXMgb25lIG1pbmUu"

## Response 400 fields (application/json):

  - `error` (any, required)

  - `error_description` (string)
    Description of error
    Example: "This is an error description"

## Response 500 fields (application/json):

  - `error` (string, required)
    Error code
    Enum: "server_error"

  - `error_description` (string)
    Description of error

## Response 503 fields (application/json):

  - `error` (string, required)
    Error code
    Enum: "service_unavailable"

  - `error_description` (string)
    Description of error