> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ibantrack.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Access Token

> Obtain an OAuth 2.0 access token to authenticate your API requests.

# Authentication

The Ibantrack API uses the **OAuth 2.0 Client Credentials** flow where you exchange your `client_id` and `client_secret` for a temporary `access_token`.

## Security Best Practices

<Note>
  **Keep your credentials secret.** Your Client ID and Client Secret have the power to perform financial verifications and incur costs. Never share them in client-side code, public repositories, or mobile applications.
</Note>

## Request Details

This specific endpoint requires the request body to be formatted as `application/x-www-form-urlencoded`.

### Required Parameters

| Parameter       | Value                | Description                           |
| :-------------- | :------------------- | :------------------------------------ |
| `grant_type`    | `client_credentials` | Must be exactly this value.           |
| `client_id`     | `YOUR_CLIENT_ID`     | Provided in your Ibantrack Dashboard. |
| `client_secret` | `YOUR_CLIENT_SECRET` | Provided in your Ibantrack Dashboard. |

## Token Lifecycle

* **Expiration**: Tokens are valid for **3600 seconds** (1 hour).
* **Caching**: We strongly recommend caching the token and reusing it until it expires. Requesting a new token for every single verification will trigger rate limits on the authentication server.

## Using the token

Once you have received the `access_token`, you must include it in the header of all subsequent API calls:

```http theme={null}
Authorization: Bearer YOUR_ACCESS_TOKEN
```


## OpenAPI

````yaml POST /oauth2/token
openapi: 3.0.0
info:
  title: Ibantrack API
  description: IBAN account holder verification API
  version: 1.0.0
servers:
  - url: https://api.ibantrack.com/api-v1
    description: Production
security: []
paths:
  /oauth2/token:
    post:
      tags:
        - Authentication
      summary: Get Access Token
      operationId: createOAuthToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
                - client_id
                - client_secret
              properties:
                grant_type:
                  type: string
                  example: client_credentials
                client_id:
                  type: string
                  example: YOUR_CLIENT_ID
                client_secret:
                  type: string
                  example: YOUR_CLIENT_SECRET
      responses:
        '200':
          description: Access token issued
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    readOnly: true
                    example: eyJhbGciOiJIUzI1NiItOvR5cCI6IkpXVCJ9....
                  token_type:
                    type: string
                    readOnly: true
                    example: Bearer
                  expires_in:
                    type: integer
                    readOnly: true
                    example: 3600
      security: []

````