Request an access token from BravoTran

Request

This endpoint is hosted by BravoTran, not the partner. Needed only if you authenticate to POST /events with OAuth 2.0 instead of an API token.

Exchanges your OAuth client credentials for an access token using the client credentials grant. Authenticate with one of:

Client ID and client secret — HTTP Basic authentication (the Authorization header), or client_id and client_secret form fields.
Certificate — client_assertion_type and client_assertion form fields, with a JWT signed by your private key.

Client credentials in the query string are rejected. See Authentication for setup and the JWT requirements.

Send the returned access_token to POST /events as Authorization: Bearer <access_token>.

Bodyapplication/x-www-form-urlencodedrequired

One of:

Send client_id and client_secret here, or omit them and use HTTP Basic authentication instead — not both.

grant_typestringrequired

Value:"client_credentials"

client_idstring

Your client ID. Omit when using HTTP Basic authentication.

client_secretstring

Your client secret. Omit when using HTTP Basic authentication.

scopestring

Optional. Returned unchanged in the response.

curl -i -X POST \
  https://apidocs.bravotran.com/_mock/openapi/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode grant_type=client_credentials \
  --data-urlencode client_id=7f2d55ad-bc27-4b50-8df8-f0432c05a0ee \
  --data-urlencode client_secret=your-client-secret

Responses

Access token issued

Headers

Cache-Controlstring

Always no-store.

Bodyapplication/json

access_tokenstringrequired

Send as Authorization: Bearer <access_token> to POST /events.

token_typestringrequired

Value:"Bearer"

expires_inintegerrequired

Seconds until the access token expires.

scopestring or null

The scope sent in the request, or null.

Response

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI3ZjJkNTVhZC1iYzI3In0.signature",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": null
}