> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Get an OAuth 2.0 access token and send it with your requests.

The Secfix Public API uses the OAuth 2.0 **client credentials** grant. Exchange your API key's
`client_id` and `client_secret` for a bearer access token. Then send that token with every request.

## Get a token

```bash cURL theme={null}
curl -X POST https://api.secfix.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"
```

```json Response theme={null}
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 86400
}
```

| Field | Meaning |
| - | - |
| `access_token` | The token to send with your requests. |
| `token_type` | Always `Bearer`. |
| `expires_in` | The token's lifetime in seconds. |

The token request can fail with:

| Status | `code` | Cause |
| - | - | - |
| `400` | `unsupported_grant_type` | `grant_type` isn't `client_credentials`. |
| `401` | `invalid_client` | The `client_id` or `client_secret` is wrong. |
| `429` | `rate_limited` | Too many token requests. See [Rate limits](https://developer-staging.secfix.com/rate-limits.md). |

## Call the API

Send the token in the `Authorization` header:

```bash theme={null}
curl https://api.secfix.com/v1/inventory/assets \
  -H "Authorization: Bearer eyJhbGciOi..."
```

## One active token per API key

Each API key has **one active token at a time**. When you request a new token or rotate the secret,
the previous token stops working. Requests with it return `401 token_superseded`.

Fetch a token, reuse it until it expires, and fetch a new one when you get a `401`.

## Workspace

A token is bound to the workspace of its API key when it is issued. You only see that workspace's
data. The API ignores any workspace value you send in a request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.