Client Credentials Flow

This authentication scheme allows an application to obtain an access token by exchanging its application credentials, such as client ID and client secret. This flow is particularly suitable for Machine-to-Machine (M2M) applications, including your application or backend services, as it enables the authentication and authorization of the application itself, rather than that of a user.

This flow works only if the Allow client credentials flow option is enabled for your API client (Configuration > Public API Client). The token’s permissions come from the roles assigned to the API client on that same screen; calling Reporting API endpoints requires the Tenant Administrator or Processing Supervisor role. A client without the option enabled receives {"error":"invalid_client"} from the token endpoint.

To obtain the access token, use the following:

A POST request.

The token resource of your tenant region:

https://vantage-us.abbyy.com/auth2/connect/token

https://vantage-eu.abbyy.com/auth2/connect/token

https://vantage-au.abbyy.com/auth2/connect/token

A Content-Type header with the application/x-www-form-urlencoded encoding.
A request body with the following parameters:

Parameter	Description
client_id	Application identifier.
client_secret	Secure application key.
grant_type=client_credentials	Specifies that the client credentials grant type is used.
scope=openid permissions global.wildcard	Specifies the permission scope.

Sample request: For Windows:

curl --location --request POST "https://vantage-us.abbyy.com/auth2/connect/token" \
  --data-urlencode "client_id=client_id" \
  --data-urlencode "client_secret=client_secret" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=openid permissions global.wildcard"

curl --location --request POST "https://vantage-eu.abbyy.com/auth2/connect/token" \
  --data-urlencode "client_id=client_id" \
  --data-urlencode "client_secret=client_secret" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=openid permissions global.wildcard"

curl --location --request POST "https://vantage-au.abbyy.com/auth2/connect/token" \
  --data-urlencode "client_id=client_id" \
  --data-urlencode "client_secret=client_secret" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=openid permissions global.wildcard"

For Linux:

curl --location --request POST 'https://vantage-us.abbyy.com/auth2/connect/token' \
  --data-urlencode 'client_id=client_id' \
  --data-urlencode 'client_secret=client_secret' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'scope=openid permissions global.wildcard'

curl --location --request POST 'https://vantage-eu.abbyy.com/auth2/connect/token' \
  --data-urlencode 'client_id=client_id' \
  --data-urlencode 'client_secret=client_secret' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'scope=openid permissions global.wildcard'

curl --location --request POST 'https://vantage-au.abbyy.com/auth2/connect/token' \
  --data-urlencode 'client_id=client_id' \
  --data-urlencode 'client_secret=client_secret' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'scope=openid permissions global.wildcard'

The server’s response to your request will contain the access token:

{
  "access_token": "<redacted>",
  "expires_in": 86400,
  "token_type": "Bearer",
  "scope": "openid permissions global.wildcard"
}

For more information about Client Credentials, visit this link.

Overview

Developer Guide