> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt
> Use this file to discover all available pages before exploring further.
# Create an access token
> Exchanges your `client_id` + `client_secret` for a platform access token (OAuth2 client credentials, RFC 6749 §4.4). The token lives one hour — when it expires, exchange again; there are no refresh tokens on this grant.
Get your credentials in the Agentcard dashboard under **Organization → Developer → Credentials**. A sandbox client mints tokens that act in sandbox; a production client acts in production.
You can also send the credentials as HTTP Basic (`Authorization: Basic base64(client_id:client_secret)`) instead of in the form body.
This endpoint is rate limited to 30 requests per 5 minutes per IP — cache the token and reuse it until it expires.
The exchange is also available at its original path, `POST
/api/v1/oauth/token` — both addresses serve the same endpoint, and existing
integrations do not need to change. New integrations should use
`/api/v2/oauth/token`.
**Test it right here** — paste your `client_id` and `client_secret` into the
playground on the right and hit **Send**. Copy the `access_token` from the
response into the **Authorization** field of any other endpoint page to call it
live. A sandbox client runs everything in sandbox.
## OpenAPI
````yaml openapi.json POST /api/v2/oauth/token
openapi: 3.1.0
info:
title: Agentcard API
version: 2.0.0
description: >-
The Agentcard v2 API — connect your users and verify their identity from
your own backend. Every call is authenticated with a platform access token
minted from your `client_id` + `client_secret`.
servers:
- url: https://api.agentcard.sh
description: >-
There is one base URL. Sandbox vs production is decided by the client
credential you use, never by the host.
security:
- platformToken: []
tags:
- name: Authentication
description: >-
Exchange your client credentials for a platform access token, and
introspect what a token acts as.
- name: Connect
description: >-
Connect a user to your platform: send a one-time code, verify it, record
consent, and keep the connection alive.
- name: Identity verification
description: >-
Verify a connected user's identity: upload their ID, submit any extra
fields we ask for, then show a short face scan.
- name: Wallet funding
description: >-
Fund a connected user's wallet from your own UI — request a payment link,
relay the phone verification code, and poll until the funds land.
- name: Withdrawals
description: >-
Move money out of a connected user's wallet — to a saved bank account or a
crypto address on Base. Transfers are processed manually by the Agentcard
team, usually within 1-3 business days.
paths:
/api/v2/oauth/token:
post:
tags:
- Authentication
summary: Create an access token
description: >-
Exchanges your `client_id` + `client_secret` for a platform access token
(OAuth2 client credentials, RFC 6749 §4.4). The token lives one hour —
when it expires, exchange again; there are no refresh tokens on this
grant.
Get your credentials in the Agentcard dashboard under **Organization →
Developer → Credentials**. A sandbox client mints tokens that act in
sandbox; a production client acts in production.
You can also send the credentials as HTTP Basic (`Authorization: Basic
base64(client_id:client_secret)`) instead of in the form body.
This endpoint is rate limited to 30 requests per 5 minutes per IP —
cache the token and reuse it until it expires.
operationId: createAccessToken
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
type: object
required:
- grant_type
- client_id
- client_secret
properties:
grant_type:
type: string
enum:
- client_credentials
description: Always `client_credentials`.
client_id:
type: string
description: Your client id, from the dashboard.
client_secret:
type: string
description: >-
Your client secret (`acs_…`), shown once when you create the
client.
responses:
'200':
description: >-
The token to send as `Authorization: Bearer ` on every
other call.
content:
application/json:
schema:
$ref: '#/components/schemas/TokenResponse'
example:
access_token: eyJhbGciOiJIUzI1NiIs…
token_type: Bearer
expires_in: 3600
scope: api
'400':
description: >-
`unsupported_grant_type` — the `grant_type` isn't
`client_credentials`. `unauthorized_client` — the client can't use
this grant.
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
example:
error: unsupported_grant_type
error_description: Only grant_type=client_credentials is supported here
'401':
description: '`invalid_client` — unknown client or bad credentials.'
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
example:
error: invalid_client
error_description: Unknown client or bad credentials
'403':
description: '`access_denied` — the organization is suspended.'
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
example:
error: access_denied
error_description: Organization is suspended
security: []
components:
schemas:
TokenResponse:
type: object
properties:
access_token:
type: string
description: >-
The platform access token. Send it as `Authorization: Bearer
` on every other endpoint.
token_type:
type: string
enum:
- Bearer
expires_in:
type: integer
description: Seconds until the token expires (3600 = one hour).
scope:
type: string
enum:
- api
OAuthError:
type: object
description: RFC 6749 §5.2 error shape — only the token endpoint uses it.
properties:
error:
type: string
description: A stable, machine-readable code.
error_description:
type: string
description: A human-readable explanation.
securitySchemes:
platformToken:
type: http
scheme: bearer
description: >-
A platform access token. Get one on the **Create an access token**
endpoint by exchanging your `client_id` + `client_secret`, then send it
as `Authorization: Bearer `. Tokens live one hour.
````