OAuth 2.0 Client Credentials
Use the OAuth 2.0 Client Credentials flow to request an access token for server-to-server integrations. Include the token in the Authorization header for every API call.
Token endpoint
Section titled “Token endpoint”- Method: POST
- Path:
/oauth2/token
Full URLs
- Test:
https://auth-test.4exchange.app/oauth2/token - Production:
https://auth.4exchange.app/oauth2/token
Request
Section titled “Request”Headers
Section titled “Headers”- Content-Type: application/x-www-form-urlencoded
- Accept: application/json
Body (form fields)
Section titled “Body (form fields)”- grant_type: client_credentials
- client_id: your assigned client ID
- client_secret: your assigned client secret
- scope: space-separated scopes (see below)
Scopes
Section titled “Scopes”Depending on your tenant’s configuration, the following scopes may be available:
- 4Exchange/receive
- 4Exchange/send
- 4Exchange/participant
- 4Exchange/webhook
Provide one or multiple, separated by a space, e.g.: 4Exchange/receive 4Exchange/send.
Responses
Section titled “Responses”200 OK
Section titled “200 OK”- 200 OK
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6...",
"token_type": "Bearer",
"expires_in": 3600
}400 Bad Request
Section titled “400 Bad Request”- 401 Bad Request
{
"error": "invalid_client"
}400 Bad Request
Section titled “400 Bad Request”- 400 Bad Request
{
"error": "invalid_scope"
}400 Bad Request
Section titled “400 Bad Request”- 400 Bad Request
{
"error": "unsupported_grant_type"
}405 Method Not Allowed
Section titled “405 Method Not Allowed”Example: using Content-Type: multipart/form-data
- 405 Method Not Allowed
- Reuse the token until it expires (expires_in). Request a new token when needed.
- Send scopes as a single, space-separated string. If only one scope is granted, include just that