Create Access Token

Exchange API Client credentials for a short-lived access token used to authenticate all subsequent API calls.

Endpoint

POST /wlte/v1/auth/token

Purpose

Issues an OpenAPI access token for a machine client.

This is not a user login endpoint. This endpoint does not require an Authorization request header.

Request

Full URL:

POST {baseUrl}/wlte/v1/auth/token

Request headers:

Content-Type: application/json
Accept: application/json

Request body:

{
  "clientId": "cli_xxxxx",
  "clientSecret": "sec_xxxxx"
}

Field rules:

• clientId is required, must be a non-empty string
• clientSecret is required, must be a non-empty string

Success Response

HTTP status:

200 OK

Response body:

{
  "code": "SUCCESS",
  "message": "OK",
  "data": {
    "accessToken": "eyJ...",
    "tokenType": "Bearer",
    "expiresIn": 3600,
    "clientId": "cli_xxxxx",
    "scopes": [
      "device:read",
      "device:control"
    ]
  }
}

Field rules:

• accessToken is a Bearer token
• tokenType is always Bearer
• expiresIn is in seconds
• The default access token lifetime is 3600 seconds
• clientId identifies the API Client that was authenticated
• scopes lists the permissions granted when the token is issued

Client handling:

• Clients should cache the access token until it is close to expiration
• Clients should request a new access token before expiresIn is reached
• After receiving 401 AUTH_EXPIRED, clients may request a new access token and retry the failed request once

Response data Schema

Field	Type	Required	Description
accessToken	string	Yes	Bearer token used in subsequent requests
tokenType	string	Yes	Always Bearer
expiresIn	integer	Yes	Token lifetime in seconds
clientId	string	Yes	API Client ID that was authenticated
scopes	string[]	Yes	Permissions granted when the token was issued

Use scopes to confirm the authorization context at issuance time. The service evaluates current permissions and application state on every request, so clients must not treat this array as a permanent permission cache.

Error Example

{
  "code": "AUTH_INVALID",
  "message": "invalid credentials"
}

Error Responses

Possible responses:

• 400 INVALID_REQUEST
• 401 AUTH_INVALID
• 403 APP_DISABLED
• 500 INTERNAL_ERROR

Notes:

• Missing clientId or clientSecret returns 400 INVALID_REQUEST
• Invalid clientId or clientSecret returns 401 AUTH_INVALID
• Disabled API clients return 403 APP_DISABLED

Rules

• This endpoint is for machine clients only, not user login
• Does not return refreshToken
• Does not return user profile data
• Does not return accountId, IP allowlists, credential status, or other internal security settings
• Request and response fields use camelCase
• This endpoint exchanges API client credentials directly for an access token