Request an access token

curl --request POST \
  --url https://api.1password.com/v1/oauth/token \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials

const encodedParams = new URLSearchParams();
encodedParams.append('grant_type', 'client_credentials');

const url = 'https://api.1password.com/v1/oauth/token';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Basic <encoded-value>',
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: encodedParams
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));

import requests

url = "https://api.1password.com/v1/oauth/token"

payload = { "grant_type": "client_credentials" }
headers = {
    "Authorization": "Basic <encoded-value>",
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.post(url, data=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.1password.com/v1/oauth/token"

	payload := strings.NewReader("grant_type=client_credentials")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Basic <encoded-value>")
	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

using RestSharp;


var options = new RestClientOptions("https://api.1password.com/v1/oauth/token");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Authorization", "Basic <encoded-value>");
request.AddParameter("grant_type", "client_credentials");
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

HttpResponse<String> response = Unirest.post("https://api.1password.com/v1/oauth/token")
  .header("Authorization", "Basic <encoded-value>")
  .header("Content-Type", "application/x-www-form-urlencoded")
  .body("grant_type=client_credentials")
  .asString();

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.1password.com/v1/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "grant_type=client_credentials",
  CURLOPT_HTTPHEADER => [
    "Authorization: Basic <encoded-value>",
    "Content-Type: application/x-www-form-urlencoded"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

$headers=@{}
$headers.Add("Authorization", "Basic <encoded-value>")
$headers.Add("Content-Type", "application/x-www-form-urlencoded")
$response = Invoke-WebRequest -Uri 'https://api.1password.com/v1/oauth/token' -Method POST -Headers $headers -ContentType 'application/x-www-form-urlencoded' -Body 'grant_type=client_credentials'

require 'uri'
require 'net/http'

url = URI("https://api.1password.com/v1/oauth/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "grant_type=client_credentials"

response = http.request(request)
puts response.read_body

{
  "access_token": "op_o_c_H3WVOKGN4B7JXQYCQ6DJFAW5ZU_Q2s4ZmVnaGprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OWFi",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "users.view users.suspend users.reactivate"
}

POST

oauth

token

Request an access token

curl --request POST \
  --url https://api.1password.com/v1/oauth/token \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials

const encodedParams = new URLSearchParams();
encodedParams.append('grant_type', 'client_credentials');

const url = 'https://api.1password.com/v1/oauth/token';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Basic <encoded-value>',
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: encodedParams
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));

import requests

url = "https://api.1password.com/v1/oauth/token"

payload = { "grant_type": "client_credentials" }
headers = {
    "Authorization": "Basic <encoded-value>",
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.post(url, data=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.1password.com/v1/oauth/token"

	payload := strings.NewReader("grant_type=client_credentials")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Basic <encoded-value>")
	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

using RestSharp;


var options = new RestClientOptions("https://api.1password.com/v1/oauth/token");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Authorization", "Basic <encoded-value>");
request.AddParameter("grant_type", "client_credentials");
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

HttpResponse<String> response = Unirest.post("https://api.1password.com/v1/oauth/token")
  .header("Authorization", "Basic <encoded-value>")
  .header("Content-Type", "application/x-www-form-urlencoded")
  .body("grant_type=client_credentials")
  .asString();

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.1password.com/v1/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "grant_type=client_credentials",
  CURLOPT_HTTPHEADER => [
    "Authorization: Basic <encoded-value>",
    "Content-Type: application/x-www-form-urlencoded"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

$headers=@{}
$headers.Add("Authorization", "Basic <encoded-value>")
$headers.Add("Content-Type", "application/x-www-form-urlencoded")
$response = Invoke-WebRequest -Uri 'https://api.1password.com/v1/oauth/token' -Method POST -Headers $headers -ContentType 'application/x-www-form-urlencoded' -Body 'grant_type=client_credentials'

require 'uri'
require 'net/http'

url = URI("https://api.1password.com/v1/oauth/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "grant_type=client_credentials"

response = http.request(request)
puts response.read_body

{
  "access_token": "op_o_c_H3WVOKGN4B7JXQYCQ6DJFAW5ZU_Q2s4ZmVnaGprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OWFi",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "users.view users.suspend users.reactivate"
}

Exchange the client ID and client secret of your OAuth application for a short-lived access token using the OAuth 2.0 client credentials grant. Send the credentials in the Authorization header with HTTP Basic authentication (recommended), or as the client_id and client_secret form fields. Use one method or the other, not both. The access token expires after 15 minutes and carries the scopes configured for your OAuth application. Include it in the Authorization header of Users API requests as Bearer <access_token>. Refresh tokens aren’t issued, so request a new access token when the current one expires. Learn how to encode your client credentials, and review the rate limits that apply to the OAuth API endpoints.

Authorizations

Authorization

string

header

required

HTTP Basic authentication with the OAuth application's client credentials: the client ID as the username and the client secret as the password, joined with a colon and base64-encoded (Authorization: Basic <base64(client_id:client_secret)>). Tools such as curl encode the credentials for you when you pass them with --user "<client_id>:<client_secret>". Alternatively, send the credentials as the client_id and client_secret form fields in the request body. Don't use both methods in the same request.

Body

application/x-www-form-urlencoded

grant_type

enum<string>

required

The OAuth 2.0 grant type. Must be client_credentials.

Available options:

client_credentials

client_id

string

The client ID of the OAuth application. Use together with client_secret as an alternative to HTTP Basic authentication.

Example:

"H3WVOKGN4B7JXQYCQ6DJFAW5ZU"

client_secret

string

The client secret of the OAuth application. Use together with client_id as an alternative to HTTP Basic authentication.

Response

An access token for the OAuth application.

access_token

string

required

The opaque access token. Include it in the Authorization header of Users API requests as Bearer <access_token>. Access tokens begin with op_o_c_.

token_type

string

required

The token type. Always Bearer.

Example:

"Bearer"

expires_in

integer

required

The lifetime of the access token in seconds. Access tokens expire after 15 minutes (900 seconds).

Example:

900

scope

string

The scopes granted to the access token, separated by spaces. These are the scopes configured for the OAuth application, for example users.view, users.suspend, and users.reactivate.

Example:

"users.view users.suspend users.reactivate"