> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Access tokens

> Exchange your client credentials for the platform token every other call needs.

An **access token** authenticates your platform. You mint it by exchanging your organization's `client_id` and `client_secret` with the OAuth2 client-credentials grant, and you send it as the bearer on every platform endpoint.

* Tokens live **one hour**. There are no refresh tokens on this grant. When one expires, exchange again.
* A **sandbox** client mints sandbox tokens; a **production** client mints production tokens. The host is the same.
* Get credentials in the dashboard under **Organization → Developer → Credentials**.

## The access token object

| Field | Type | Description |
| - | - | - |
| `access_token` | string | The bearer for every platform endpoint. |
| `token_type` | string | Always `Bearer`. |
| `expires_in` | integer | Seconds until expiry. Always 3600. |
| `scope` | string | Always `api`. |

```json theme={null}
{ "access_token": "eyJhbGciOiJIUzI1NiIs…", "token_type": "Bearer", "expires_in": 3600, "scope": "api" }
```

Introspecting a token returns an `api_v2` object: `organization_id` and `test_mode` (true for a sandbox client).

## Endpoints

| Endpoint | |
| - | - |
| `POST /api/v2/oauth/token` | [Create an access token](/api-reference/access-tokens/create) |
| `GET /api/v2` | [Introspect credential](/api-reference/access-tokens/introspect): which organization and mode a token acts as |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.