> ## Documentation Index > Fetch the complete documentation index at: https://guide.getkroo.com/llms.txt > Use this file to discover all available pages before exploring further. # Issue an access token > Exchanges client credentials for a short-lived Bearer token used to authenticate subsequent v3 API requests. Submit `grant_type=client_credentials` together with your `client_id` and `client_secret`. The response includes the `access_token` to send as `Authorization: Bearer `, the `token_type` (always `Bearer`), the lifetime in seconds, and the space-delimited `scope` actually granted. **Scopes:** omit the `scope` parameter to receive every scope your client is registered for, or pass a subset (space-delimited). A request for a scope outside your client's registered set returns `invalid_scope`. **Auth:** the token endpoint itself is unauthenticated (no Bearer header). Authentication is performed by the `client_id` / `client_secret` pair you send in the body. **400 error codes** (RFC 6749 §5.2): - `invalid_client` — missing or wrong `client_id` / `client_secret`. - `unsupported_grant_type` — `grant_type` is not `client_credentials`. - `unauthorized_client` — the client is not registered for the `client_credentials` grant. - `invalid_scope` — the requested `scope` exceeds the client's registered scope set. ## OpenAPI ````yaml https://api.getkroo.com/api/v3/openapi.yaml post /oauth/token openapi: 3.0.1 info: title: Kroo API v3 version: 1.0.0 description: | OAuth 2.0 Client Credentials authenticated API for machine-to-machine integrations. ## Authentication All v3 endpoints require Bearer token authentication. Request a token from `/oauth/token` with your client credentials, then send it on subsequent requests as `Authorization: Bearer `. Tokens expire after 1 hour. ## Rate Limiting - V3 API endpoints: 60 requests per minute per IP - OAuth token endpoint: 10 requests per minute per IP Every response carries `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers. When the limit is exceeded the server returns `429 rate_limit_exceeded`; back off until the `X-RateLimit-Reset` Unix timestamp and retry. contact: name: Kroo API Support email: implementations@getkroo.com servers: - url: https://api.getkroo.com/api/v3 description: Production security: - BearerAuth: [] tags: - name: Authentication description: >- Exchange client credentials for short-lived Bearer tokens used to authorize every other v3 request. - name: Schedule Files description: >- Upload, list, retrieve, and delete P6 schedule files (XER, XML, PPX). Uploads are parsed and ingested asynchronously. paths: /oauth/token: post: tags: - Authentication summary: Issue an access token description: | Exchanges client credentials for a short-lived Bearer token used to authenticate subsequent v3 API requests. Submit `grant_type=client_credentials` together with your `client_id` and `client_secret`. The response includes the `access_token` to send as `Authorization: Bearer `, the `token_type` (always `Bearer`), the lifetime in seconds, and the space-delimited `scope` actually granted. **Scopes:** omit the `scope` parameter to receive every scope your client is registered for, or pass a subset (space-delimited). A request for a scope outside your client's registered set returns `invalid_scope`. **Auth:** the token endpoint itself is unauthenticated (no Bearer header). Authentication is performed by the `client_id` / `client_secret` pair you send in the body. **400 error codes** (RFC 6749 §5.2): - `invalid_client` — missing or wrong `client_id` / `client_secret`. - `unsupported_grant_type` — `grant_type` is not `client_credentials`. - `unauthorized_client` — the client is not registered for the `client_credentials` grant. - `invalid_scope` — the requested `scope` exceeds the client's registered scope set. operationId: createAccessToken parameters: [] requestBody: content: application/x-www-form-urlencoded: schema: type: object required: - grant_type - client_id - client_secret properties: grant_type: type: string enum: - client_credentials description: >- OAuth 2.0 grant type. Only `client_credentials` is supported on this endpoint for confidential clients. client_id: type: string description: Issued when the API client was created. client_secret: type: string description: Issued when the API client was created. scope: type: string description: >- Optional space-delimited list of scopes to request. Defaults to the client's full registered scope set. example: read:schedule_files write:schedule_files required: true responses: '200': description: Access token issued content: application/json: schema: type: object required: - access_token - token_type - expires_in - scope properties: access_token: type: string description: >- Bearer token to send in `Authorization: Bearer `. Treat it as a secret; tokens are bearer credentials. example: >- f4a91d2bce7c4f0a9b8e3d6c5a2f1e8b9d7c6a5b4e3f2d1c0b9a8e7d6c5b4a3f token_type: type: string enum: - Bearer description: >- Always `Bearer`. Use as the auth scheme in the `Authorization` header. example: Bearer expires_in: type: integer description: Seconds until the token expires (3600 = 1 hour). example: 3600 scope: type: string description: >- Space-delimited list of scopes actually granted on this token. May be narrower than what you requested if some scopes are not registered on the client. example: read:schedule_files write:schedule_files '400': description: >- Authentication or request failure (see operation description for error codes) content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Rate limit exceeded headers: X-RateLimit-Limit: schema: type: integer description: Requests allowed in the current window. X-RateLimit-Remaining: schema: type: integer description: Requests remaining in the current window. X-RateLimit-Reset: schema: type: integer format: int64 description: Unix timestamp when the window resets. content: application/json: schema: $ref: '#/components/schemas/Error' security: [] components: schemas: Error: type: object required: - error - error_description properties: error: type: string description: >- Machine-readable error code. See the operation description for the codes a specific endpoint can return. error_description: type: string description: >- Human-readable description of the error. Safe to log; do not show to end users verbatim. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Bearer token obtained from `POST /oauth/token`. Send as `Authorization: Bearer `. Tokens expire after 1 hour; refresh by requesting a new one with the same client credentials. ````