Get a token
Exchange your client id and secret for a bearer token. The body is JSON, not the form-encoded body of
standard OAuth2: there is no grant_type, and no scope, because the scopes are fixed on your
credential.
A token lasts 24 hours. Reuse it for every call until it is within 10 minutes of expire_at. Asking
again before then returns the same token.
Body·
required
application/json
- Type: stringFormat: uuidclient
_id required - Type: stringFormat: uuidclient
_secret required
Responses
- application/json
- application/json
- 422
The body is not JSON, or a field is missing.
Request Example for post/v1/auth/token
curl https://api.sandbox.vatcompliance.com/v1/auth/token \
--request POST \
--header 'Content-Type: application/json' \
--data '{
"client_id": "3f6c2a1e-7b4d-4c9a-9e21-5d8f0b7a6c34",
"client_secret": "00000000-0000-0000-0000-000000000000"
}'
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.example.signature",
"token_type": "Bearer",
"expires_in": 86400,
"scope": "read:transactions write:transactions",
"created_at": "2026-11-06T09:00:00Z",
"expire_at": "2026-11-07T09:00:00Z"
}