# Authentication

CartonCloud authentication follows the [OAuth2](https://tools.ietf.org/html/rfc6749) specifications.

Tenants and customers integrating with the API are required to use the client credentials grant type to obtain an Access Token.

For information on generating API Keys, refer to our Knowledge Base Article: [API Clients](https://help.cartoncloud.com/help/s/article/API-Clients)

## Client Credentials

An access token can be obtained using the client credentials

### HTTP Request

> Example Request

```shell
curl -u {clientId}:{clientSecret} \
   "https://api.cartoncloud.com/uaa/oauth2/token" \
   -X POST \
   -H "Accept-Version: 1" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d grant_type="client_credentials"
```

`POST https://api.cartoncloud.com/uaa/oauth2/token`

`POST /uaa/oauth/token` is still accepted; the gateway rewrites it to `/uaa/oauth2/token`.

### Authentication

The following client credentials can be obtained from a user with administrator access.
The clientId and clientSecret should be set in the [HTTP Basic Auth Header](https://tools.ietf.org/html/rfc7617)

| Credential | Description |
| --- | --- |
| `clientId` | The username for requests to the token end point |
| `clientSecret` | The password for requests to the token end point |

### Request Parameters

| Parameter | Description |
| --- | --- |
| `grant_type` | Must be `client_credentials` |

### Response Properties

> Example Response JSON

```json
{
  "access_token": "{accessToken}",
  "token_type": "bearer",
  "expires_in": 3600
}
```

| Property | Description |
| --- | --- |
| `access_token` | Access token to be used to authenticate subsequent API requests |
| `token_type` | Will always be `bearer` |
| `expires_in` | The number of seconds after which the access token will expire and will no longer be valid |

## Access Token

> Example Request

```shell
# Send the access token with every request
curl "https://api_endpoint" \
  -H "Accept-Version: 1" \
  -H "Authorization: Bearer {accessToken}"
```

With every API request a valid access token must be supplied in the request header as a [Bearer Tokens](https://tools.ietf.org/html/rfc6750)

`Authorization: Bearer {accessToken}`

## Software Vendors

Software vendors interested in providing out of the box integration into CartonCloud are required to use [OAuth2](https://tools.ietf.org/html/rfc6749) authorization code flow to connect.