To access your API, you must request an access token when authenticating a user.
These Auth0 tools help you modify your application to authenticate users:
  • Quickstarts are the easiest way to implement authentication. They show you how to use Universal Login and Auth0’s language- and framework-specific SDKs.
  • The Auth0 Authentication API is a reference for those who prefer to write code independently. First, identify which flow to use. Then follow the instructions to implement that flow.
To request an , make a POST call to the token URL.

​
Example POST to token URL

curl --request POST \
  --url 'https://{yourDomain}/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data audience=YOUR_API_IDENTIFIER
Parameters
Parameter NameDescription
grant_typeSet this to “client_credentials”.
client_idYour application’s Client ID. You can find this value on the application’s settings tab.
client_secretYour application’s Client Secret. You can find this value on the application’s settings tab. To learn more about available application authentication methods, read Application Credentials.
audienceThe audience for the token, which is your API. You can find this in the Identifier field on your API’s settings tab.
organizationOptional. The organization name or identifier you want the request to be associated with. To learn more, read Machine-to-Machine Access for Organizations.

​
Response

You receive an HTTP 200 response with a payload containing access_token, token_type, and expires_in values: 
{
  "access_token":"eyJz93a...k4laUWw",
  "token_type":"Bearer",
  "expires_in":86400
}
Validate your tokens before saving them. To learn how, read Validate ID Tokens and Validate Access Tokens.

​
Control access token audience

When a user authenticates, you request an access token and include the target and scope of access in your request. The application uses the /authorize endpoint to request access. This access is both requested by the application and granted by the user during authentication You can configure your tenant to always include a default audience.
Token UseFormatRequested AudienceRequested Scope
/userinfo endpointOpaquetenant name ({yourDomain}), no value for audience parameter, no audience parameter passedopenid
Auth0 Management APIJWTManagement API v2 identifier (https://{tenant}.auth0.com/api/v2/)
Your own custom APIJWTThe API Identifier for your custom API registered in the Auth0 Dashboard
In only one specific instance, access tokens can have multiple target audiences. This requires that your custom API’s is set to RS256. To learn more, read Token Best Practices.

​
Multiple audiences

If you specify an audience of your custom API identifier and a scope of openid, then the resulting access token’s aud claim will be an array rather than a string, and the access token will be valid for both your custom API and for the /userinfo endpoint. Your access tokens can only have two or more audiences if you use a single custom API as well as Auth0’s /userinfo endpoint.

​
Custom domains and the Auth0 Management API

Auth0 issues tokens with an issuer (iss) claim of whichever domain you used when requesting the token. Custom domain users can use either their or their Auth0 domain. For example, suppose you have a custom domain, https://login.northwind.com. If you request an access token from https://login.northwind.com/authorize, your token’s iss claim will be https://login.northwind.com/. However, if you request an access token from https://northwind.auth0.com/authorize, your token’s iss claim will be https://northwind.auth0.com/. If you request an access token from your custom domain with the target audience of the Auth0 , then you must call the Auth0 Management API from your custom domain. Otherwise your access token is considered invalid.

​
Renew access tokens

By default, an access token for a custom API is valid for 86400 seconds (24 hours). You can shorten the time period before the token expires. After an access token has expired, you can renew your access token. To do so either re-authenticate the user using Auth0 or use a refresh token.

​
Learn more