> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Client Credentials Flow

> Use the OAuth 2.0 Client Credentials flow for ABBYY Vantage machine-to-machine integrations: exchange client ID and secret for an API access token.

This authentication scheme allows an application to obtain an access token by exchanging its application credentials, such as client ID and client secret. This flow is particularly suitable for Machine-to-Machine (M2M) applications, including your application or backend services, as it enables the authentication and authorization of the application itself, rather than that of a user.

<Warning>
  This flow works only if the **Allow client credentials flow** option is enabled for your API client (**Configuration** > **Public API Client**). The token's permissions come from the roles assigned to the API client on that same screen; calling Reporting API endpoints requires the Tenant Administrator or Processing Supervisor role. A client without the option enabled receives `{"error":"invalid_client"}` from the token endpoint.
</Warning>

To obtain the access token, use the following:

1. A POST request.

2. The `token` resource of your tenant region:

   <CodeGroup>
     ```text US theme={null}
     https://vantage-us.abbyy.com/auth2/connect/token
     ```

     ```text EU theme={null}
     https://vantage-eu.abbyy.com/auth2/connect/token
     ```

     ```text AU theme={null}
     https://vantage-au.abbyy.com/auth2/connect/token
     ```
   </CodeGroup>

3. A `Content-Type` header with the `application/x-www-form-urlencoded` encoding.

4. A request body with the following parameters:

| Parameter                                | Description                                               |
| ---------------------------------------- | --------------------------------------------------------- |
| client\_id                               | Application identifier.                                   |
| client\_secret                           | Secure application key.                                   |
| grant\_type=client\_credentials          | Specifies that the client credentials grant type is used. |
| scope=openid permissions global.wildcard | Specifies the permission scope.                           |

Sample request:

For Windows:

<CodeGroup>
  ```shell US theme={null}
  curl --location --request POST "https://vantage-us.abbyy.com/auth2/connect/token" \
    --data-urlencode "client_id=client_id" \
    --data-urlencode "client_secret=client_secret" \
    --data-urlencode "grant_type=client_credentials" \
    --data-urlencode "scope=openid permissions global.wildcard"
  ```

  ```shell EU theme={null}
  curl --location --request POST "https://vantage-eu.abbyy.com/auth2/connect/token" \
    --data-urlencode "client_id=client_id" \
    --data-urlencode "client_secret=client_secret" \
    --data-urlencode "grant_type=client_credentials" \
    --data-urlencode "scope=openid permissions global.wildcard"
  ```

  ```shell AU theme={null}
  curl --location --request POST "https://vantage-au.abbyy.com/auth2/connect/token" \
    --data-urlencode "client_id=client_id" \
    --data-urlencode "client_secret=client_secret" \
    --data-urlencode "grant_type=client_credentials" \
    --data-urlencode "scope=openid permissions global.wildcard"
  ```
</CodeGroup>

For Linux:

<CodeGroup>
  ```shell US theme={null}
  curl --location --request POST 'https://vantage-us.abbyy.com/auth2/connect/token' \
    --data-urlencode 'client_id=client_id' \
    --data-urlencode 'client_secret=client_secret' \
    --data-urlencode 'grant_type=client_credentials' \
    --data-urlencode 'scope=openid permissions global.wildcard'
  ```

  ```shell EU theme={null}
  curl --location --request POST 'https://vantage-eu.abbyy.com/auth2/connect/token' \
    --data-urlencode 'client_id=client_id' \
    --data-urlencode 'client_secret=client_secret' \
    --data-urlencode 'grant_type=client_credentials' \
    --data-urlencode 'scope=openid permissions global.wildcard'
  ```

  ```shell AU theme={null}
  curl --location --request POST 'https://vantage-au.abbyy.com/auth2/connect/token' \
    --data-urlencode 'client_id=client_id' \
    --data-urlencode 'client_secret=client_secret' \
    --data-urlencode 'grant_type=client_credentials' \
    --data-urlencode 'scope=openid permissions global.wildcard'
  ```
</CodeGroup>

The server's response to your request will contain the access token:

```json theme={null}
{
  "access_token": "<redacted>",
  "expires_in": 86400,
  "token_type": "Bearer",
  "scope": "openid permissions global.wildcard"
}
```

For more information about Client Credentials, visit [this link](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4).