-
-
- {`curl --location '${appendPath(props.endpoint, '/oidc/token')}' \\
- --request POST \\
- # Credentials are constructed by ":" and encoded in base64
- --header 'Authorization: Basic ${Buffer.from(`${props.app.id}:${props.app.secret}`).toString(
- 'base64'
- )}' \\
- --header 'Content-Type: application/x-www-form-urlencoded' \\
- --data-urlencode 'grant_type=client_credentials' \\
- --data-urlencode 'resource=https://shopping.api' \\
- --data-urlencode 'scope=scope_1 scope_2' # Optional scope(s)
-`}
-
-
+
+In the following demonstration, replace `https://your.logto.endpoint` with the Logto endpoint you are targeting. For Logto Cloud, it will be `https://[your-tenant-id].logto.app`.
+
-### Token response
+
-A successful response body would be like:
+
+
+Logto provides a built-in “Logto Management API” resource, it’s a readonly resource with the `all` permission to access Logto Management API, you can see it from your API resource list.
+The resource API indicator is in the pattern of `https://[your-tenant-id].logto.app/api` , and this will be your resource value used in the access token request body.
+
+
+
+Before accessing Logto Management API, make sure your M2M app has been assigned with M2M roles that include the `all` permission from this built-in “Logto Management API” resource.
+
+Now, compose all we have and send the request:
+
+
+
+
+```js
+const logtoEndpoint = 'https://your.logto.endpoint'; // Replace with your Logto endpoint
+const tokenEndpoint = `${logtoEndpoint}/oidc/token`;
+const applicationId = 'your-application-id';
+const applicationSecret = 'your-application-secret';
+const tenantId = 'your-tenant-id';
+
+const fetchAccessToken = async () => {
+ return await fetch(tokenEndpoint, {
+ method: 'POST',
+ headers: {
+ 'Content-Type': 'application/x-www-form-urlencoded',
+ Authorization: `Basic ${Buffer.from(`${applicationId}:${applicationSecret}`).toString(
+ 'base64'
+ )}`,
+ },
+ body: new URLSearchParams({
+ grant_type: 'client_credentials',
+ resource: `https://${tenantId}.logto.app/api`,
+ scope: 'all',
+ }).toString(),
+ });
+};
+```
+
+
+
+
+
+```bash
+curl --location \
+ --request POST 'https://your.logto.endpoint' \ # Replace with your Logto endpoint
+ --header 'Authorization: Basic ${your_auth_string}' \
+ --header 'Content-Type: application/x-www-form-urlencoded' \
+ --data-urlencode 'grant_type=client_credentials' \
+ --data-urlencode 'resource=https://${tenantId}.logto.app/api' \
+ --data-urlencode 'scope=all'
+```
+
+
+
+
+
+
+For Logto Cloud users: when you’re interacting with Logto Management API, you can not use custom domain, use the default Logto endpoint `https://[your_tenant_id].logto.app/oidc/token` to grant access tokens.
+
+
+### Access token response
+
+A successful access token response body would be like:
```json
{
"access_token": "", // Use this token to access the API resource
"expires_in": 3600, // Token expiration in seconds
- "token_type": "Bearer" // Auth type for your request when using the access token
+ "token_type": "Bearer", // Auth type for your request when using the access token
+ "scope": "all" // scope `all` for Logto Management API
}
```
+
+Logto does not currently support the M2M app to represent a user. The `sub` in the access token payload will be the App ID.
+
+
+
+
+
+
+In your API Resource list, find the API identifier that the app needs to access. If you haven't added the API Resource in Logto or don't know what API Resource is, see [API Resource](/docs/references/resources).
+
+
+
+Assume that we have `read:products` and `write:products` permissions under this “Online Shopping” API resource.
+
+Before accessing your API resource, make sure your M2M app has been assigned with M2M roles that include permissions from your API resource.
+
+Now, compose all we have and send the request:
+
+
+
+
+
+```js
+const logtoEndpoint = 'https://your.logto.endpoint';
+const tokenEndpoint = `${logtoEndpoint}/oidc/token`;
+const applicationId = 'your-application-id';
+const applicationSecret = 'your-application-secret';
+
+const fetchAccessToken = async () => {
+ return await fetch(tokenEndpoint, {
+ method: 'POST',
+ headers: {
+ 'Content-Type': 'application/x-www-form-urlencoded',
+ Authorization: `Basic ${Buffer.from(`${applicationId}:${applicationSecret}`).toString(
+ 'base64'
+ )}`,
+ },
+ body: new URLSearchParams({
+ grant_type: 'client_credentials',
+ resource: 'https://shopping.api',
+ scope: 'read:products write:products',
+ }).toString(),
+ });
+};
+```
+
+
+
+
+
+```bash
+curl --location \
+ --request POST 'https://your.logto.endpoint/oidc/token' \
+ --header 'Authorization: Basic ${your_auth_string}' \
+ --header 'Content-Type: application/x-www-form-urlencoded' \
+ --data-urlencode 'grant_type=client_credentials' \
+ --data-urlencode 'resource=https://shopping.api' \
+ --data-urlencode 'scope=read:products write:products'
+```
+
+
+
+
+
+### Access token response
+
+A successful access token response body would be like:
+
+```json
+{
+ "access_token": "", // Use this token to access the API resource
+ "expires_in": 3600, // Token expiration in seconds
+ "token_type": "Bearer", // Auth type for your request when using the access token
+ "scope": "read:products write:products" // scopes for the access token
+}
+```
+
+
+
+
+