# Access Tokens

All requests made to the Open Payments API requires an access token. Requesting an access token requires you to provide your `client_id` and `client_secret`, which were generated when you created your application in the Developer Portal. 

:::lock

We use OAuth2 with client credentials for authentication which is a well-known standard. Please use a library for authenticating with us instead of coding it yourself. 

:::

Access tokens are valid for one hour and belong to a certain [scope](enums.md#scope). An access token's scope is composed of an API scope and a PSU context scope, with each accepting the following values:

| API Scope Values      | Description                                                                                                                                             |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `aspspinformation`    | Grants access to the ASPSP Information Service.                                                                                                         |
| `accountinformation`  | Grants access to the Account Information Service.                                                                                                       |
| `paymentinitiation`   | Grants access to the Payment Initiation Service, ISO Payments, FX Connect, KYC, Payout Service, Bankgiro Lookup, and SEPA Direct Debit.                 |
| `bankgiroinformation` | Used in combination with the `accountinformation` scope to grant additional access to ISO enrichment of transactions from the Swedish Bankgirot system. |

| PSU Context Scope Values | Description                            |
| ------------------------ | -------------------------------------- |
| `private`                | Used when accessing personal accounts. |
| `corporate`              | Used when accessing business accounts. |

:::zap

When requesting access tokens, combine all API scopes that are relevant for your application where possible, and keep one active token per PSU context at a time. If you have both private and corporate PSUs, you should then have max two access tokens per hour.

:::

This guide shows you how to acquire an access token with `scope` `accountinformation corporate`, allowing you to make requests to the Account Information Service (AIS) API for corporate accounts.  

### Request Access Token

#### Endpoint

```http
POST /connect/token
```

#### Request Body

| Name            | Type         | Description                                                                                                                                                         |
| --------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `client_id`     | string       | The Client ID of the application you created in the Developer Portal.                                                                                               |
| `client_secret` | string       | The secret key that was generated when the application was created in the Developer Portal.                                                                                                 |
| `grant_type`    | string(enum) | Specifies the OAuth 2.0 grant flow to use. For client-based access tokens, this should be `client_credentials`.                                                     |
| `scope`         | string       | Specifies the level of access requested. It is a space-separated string combining API scopes (e.g. `accountinformation`) and PSU context scopes (e.g. `corporate`). |

```bash
curl -X POST "https://auth.openbankingplatform.com/connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=<YOUR_CLIENT_ID>" \
  -d "client_secret=<YOUR_CLIENT_SECRET>" \
  -d "grant_type=client_credentials" \
  -d "scope=accountinformation corporate"
```

#### Response
```json
{
  "access_token": "<ACCESS_TOKEN>",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "accountinformation corporate"
}
```
You now have an access token that you can use as authentication to make requests to the AIS API. 

:::warning 

The access token expires after **one hour**. You must make this request again to obtain a new one.

:::