# Exchange for an access token: client_credentials (client_id = channel code, client_secret = secret) or password (username = OMS login account, password = OMS password) → Bearer access_token

`POST /api/v1/auth/token` — No token

Auth

## Request body (JSON)

| Field | Type | Description |
| --- | --- | --- |
| `grant_type` | string | OAuth2 grant type: client_credentials (channel code + secret) or password (OMS account + password). May be omitted: if username is given it is treated as password, otherwise client_credentials. |
| `client_id` | string | Channel code (the OAuth2 client_id), issued by your account manager; for the client_credentials grant. Use sandbox to try things out. (max length 32 · format ^[A-Za-z0-9_-]+$) |
| `client_secret` | string | Channel secret (the OAuth2 client_secret); for the client_credentials grant. Use sandbox to try things out (the sandbox returns demo data and never touches real stock). (max length 256) |
| `username` | string | Your OMS website login account (password grant), e.g. 100470admin; we recommend a dedicated sub-account for system integration. Use sandbox to try things out. (max length 64) |
| `password` | string | Your OMS login password (password grant). Only handled at token exchange — the gateway never stores or logs it. Use sandbox to try things out. (max length 256) |

## Response

The envelope is decided by the HTTP status alone: 2xx with `{ data: … }` (lists also carry `page / page_size / has_more` or `total_count`); 4xx / 5xx with `{ error: { code, message, hint, request_id, doc_url } }`.

```json
{
  "data": { "access_token": "eyJhbGciOi…", "token_type": "Bearer", "expires_in": 3600, "expires_at": "2026-09-03T06:27:28.000Z" }
}
```

A success response carries no human-readable text — no `code / result / msg`. `error.code` is the only field your code should branch on; `message` follows `Accept-Language`.

## Examples

### curl

```bash
curl -X POST "https://connect.everugg.net.au/api/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d '{ "grant_type": "client_credentials", "client_id": "<CHANNEL>", "client_secret": "<SECRET>" }'
```

### Python

```python
import requests

r = requests.post(
    "https://connect.everugg.net.au/api/v1/auth/token",
    json={
      "grant_type": "client_credentials",
      "client_id": "<CHANNEL>",
      "client_secret": "<SECRET>"
    },
)
data = r.json()
r.raise_for_status()  # 4xx/5xx: data["error"]["code"] / ["hint"]
```

### Node

```js
const res = await fetch("https://connect.everugg.net.au/api/v1/auth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "grant_type": "client_credentials",
    "client_id": "<CHANNEL>",
    "client_secret": "<SECRET>"
  }),
})
const data = await res.json()
if (!res.ok) throw new Error(`${data.error?.code}: ${data.error?.message}`)
```

### Java

```java
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("https://connect.everugg.net.au/api/v1/auth/token"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString("{ \"grant_type\": \"client_credentials\", \"client_id\": \"<CHANNEL>\", \"client_secret\": \"<SECRET>\" }"))
    .build();
HttpResponse<String> res = HttpClient.newHttpClient().send(req, HttpResponse.BodyHandlers.ofString());
```

---
Markdown source: https://connect.everugg.net.au/reference/post-api-v1-auth-token.md?lang=en · Web page: https://connect.everugg.net.au/reference?op=post-api-v1-auth-token&lang=en