Access tokens - Agentcard

An access token authenticates your platform. You mint it by exchanging your organization’s client_id and client_secret with the OAuth2 client-credentials grant, and you send it as the bearer on every platform endpoint.

Tokens live one hour. There are no refresh tokens on this grant. When one expires, exchange again.
A sandbox client mints sandbox tokens; a production client mints production tokens. The host is the same.
Get credentials in the dashboard under Organization → Developer → Credentials.

The access token object

Field	Type	Description
`access_token`	string	The bearer for every platform endpoint.
`token_type`	string	Always `Bearer`.
`expires_in`	integer	Seconds until expiry. Always 3600.
`scope`	string	Always `api`.

{ "access_token": "eyJhbGciOiJIUzI1NiIs…", "token_type": "Bearer", "expires_in": 3600, "scope": "api" }

Introspecting a token returns an api_v2 object: organization_id and test_mode (true for a sandbox client).

Endpoints

Endpoint
`POST /api/v2/oauth/token`	Create an access token
`GET /api/v2`	Introspect credential: which organization and mode a token acts as