OAuth2 token (client credentials)

Exchange an OAuth2 client's credentials for a short-lived bearer (the client_credentials grant). This endpoint is unauthenticated (it carries no bearer and requires no scope) — it is the auth bootstrap.

A token created as an OAuth2 client (see Settings → API Suite, auth method "OAuth2 client credentials") is issued a client_id (prefixed hlmc_) and a one-time client_secret (prefixed hlms_) instead of a static hlm_ bearer. POST them here to receive an access_token (prefixed hlma_) valid for expires_in seconds (3600 by default). Use that access token as the bearer on the API exactly like a static token:

Authorization: Bearer hlma_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The optional scope (space-delimited) narrows the access token to a subset of the client's own scopes; omit it to inherit the client's full scope set. Requesting a scope the client does not hold is an invalid_scope error. Errors follow the OAuth2 shape ({ error, error_description }); invalid_client is deliberately opaque and never reveals whether the id or the secret was wrong.

{
  "grant_type": "client_credentials",
  "client_id": "hlmc_xxxxxxxxxxxxxxxxxxxxxxxx",
  "client_secret": "hlms_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "scope": "investors:read deals:read"
}

{
  "access_token": "hlma_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "investors:read deals:read"
}

curl -X POST https://your-org-domain/kong/core/api/v2/oauth/token\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "grant_type": "client_credentials",
  "client_id": "hlmc_xxxxxxxxxxxxxxxxxxxxxxxx",
  "client_secret": "hlms_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "scope": "investors:read deals:read"
}'