01 Get access token | Global Airport Concierge

Exchanges your OAuth client credentials for a bearer token. Every other request in this collection needs it.

grant_type is forced to client_credentials server-side, so you never send it, and no refresh token is issued. Ask for a new token when the old one expires.

Request — send client_id and client_secret. Form encoding, JSON and query parameters all work.

Response — this endpoint is the one exception to the standard envelope. It returns the raw OAuth payload with no message / status / responseTime wrapper:

1 { "token_type": "Bearer", "expires_in": 31536000, "access_token": "eyJ0eXAi…" }

Send it on every subsequent call as Authorization: Bearer <access_token>. The collection does this for you via the {{token}} variable, which the test script on this request sets automatically.

Status	`error_code`	When
`200`	—	Credentials accepted. Raw OAuth payload, no envelope.
`401`	`invalid_client_credentials`	`client_id` or `client_secret` rejected, client revoked, or client not linked to a company.
`429`	`rate_limit_exceeded`	More than 300 requests in a minute.
`500`	`server_error`	Our fault. The message carries a reference to quote to support.

Token lifetime is one year (expires_in: 31536000). Every call mints an additional token and revokes nothing, so cache the token rather than requesting one per API call.

Exchanges your OAuth client credentials for a bearer token. Every other request in this collection needs it. `grant_type` is forced to `client_credentials` server-side, so you never send it, and no refresh token is issued. Ask for a new token when the old one expires. **Request** — send `client_id` and `client_secret`. Form encoding, JSON and query parameters all work. **Response** — this endpoint is the one exception to the standard envelope. It returns the raw OAuth payload with no `message` / `status` / `responseTime` wrapper: ```json { "token_type": "Bearer", "expires_in": 31536000, "access_token": "eyJ0eXAi…" } ``` Send it on every subsequent call as `Authorization: Bearer <access_token>`. The collection does this for you via the `{{token}}` variable, which the test script on this request sets automatically. | Status | `error_code` | When | | --- | --- | --- | | `200` | — | Credentials accepted. Raw OAuth payload, no envelope. | | `401` | `invalid_client_credentials` | `client_id` or `client_secret` rejected, client revoked, or client not linked to a company. | | `429` | `rate_limit_exceeded` | More than 300 requests in a minute. | | `500` | `server_error` | Our fault. The message carries a reference to quote to support. | **Token lifetime is one year** (`expires_in: 31536000`). Every call mints an additional token and revokes nothing, so cache the token rather than requesting one per API call.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects a multipart form.

client_idstringRequired

client_secretstringRequired

Response

token_typestring

expires_ininteger

access_tokenstring

Errors

401

Unauthorized Error