---
updatedAt: 2026-08-18T12:18:09.000Z
---

Fetch the complete documentation index at: https://developers.deliverect.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Get Access Token

## API Credentials

Deliverect uses **OAuth 2.0** for API authentication. When a partner is registered, a `client_id` and `client_secret` are issued for use in the staging environment. These credentials are used to obtain an `access_token`, which must be included as a Bearer token in the Authorization header of all API requests.

```text Bearer Token
Authorization: Bearer your-access-token
```

<HTMLBlock>{`
<div class="callout-banner callout-banner--note">
  <span class="callout-icon"><i class="fa-duotone fa-solid fa-lightbulb"></i></span>
  <p>
    <strong>Production Credentials</strong><br>
    Certification is required before granting API access to our production environment.
  </p>
</div>
`}</HTMLBlock>

## Token Expiry & Caching

Access tokens expire at the time specified in `expires_at`. Always cache and reuse tokens until expiry. Do not request a new token for every API call.

<HTMLBlock>{`
<div class="callout-banner callout-banner--important">
  <span class="callout-icon"><i class="fa-duotone fa-solid fa-triangle-exclamation"></i></span>
  <p>

    API credentials should be stored securely and never shared with customers
  </p>
</div>
`}</HTMLBlock>

### Scopes

Scopes define the permissions associated with your access token, a complete list of available scopes below are granted according to the agree integration format

| Scope                            | Access                                   |
| :------------------------------- | :--------------------------------------- |
| `genericCommerce`                | All endpoints within the Commerce API    |
| `genericChannel:{channel_scope}` | All endpoints within the Channel API     |
| `genericPOS`                     | All endpoints within the POS + Store API |
| `store`                          | All endpoints within the Store API       |
| `genericFulfillment`             | All endpoints within the Dispatch API    |
| `genericKDS`                     | All endpoints within the KDS API         |
| `payments`                       | All endpoints within the DPAY API        |

### Webhook HMAC Authentication

Deliverect signs all outbound webhook requests using HMAC authentication.

Refer to the HMAC Authentication Guide for implementation details:

<HTMLBlock>{`
<a href="https://developers.deliverect.com/reference/hmac-authentication" target="_blank" class="doc-button">▶ HMAC Authentication</a>
`}</HTMLBlock>

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "Oauth2",
    "version": "1.0"
  },
  "servers": [
    {
      "url": "https://api.staging.deliverect.com/"
    }
  ],
  "components": {
    "securitySchemes": {
      "oauth2ClientCredentials": {
        "type": "oauth2",
        "description": "Obtain an access token using the partner client ID and client secret. Send the returned token with each API request in the Authorization header as a Bearer token.",
        "flows": {
          "clientCredentials": {
            "tokenUrl": "/oauth/token",
            "scopes": {}
          }
        }
      }
    }
  },
  "security": [
    {
      "oauth2ClientCredentials": []
    }
  ],
  "paths": {
    "/oauth/token": {
      "post": {
        "summary": "Get Access Token",
        "description": "",
        "operationId": "machine-2-machine-access-token",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "client_id",
                  "client_secret",
                  "audience",
                  "grant_type"
                ],
                "properties": {
                  "client_id": {
                    "type": "string",
                    "default": "{clientId}"
                  },
                  "client_secret": {
                    "type": "string",
                    "default": "{clientSecret}"
                  },
                  "audience": {
                    "type": "string",
                    "default": "https://api.staging.deliverect.com"
                  },
                  "grant_type": {
                    "type": "string",
                    "default": "client_credentials"
                  }
                }
              },
              "examples": {
                "Token Request Example": {
                  "summary": "Token Request Example",
                  "value": {
                    "client_id": "{clientId}",
                    "client_secret": "{clientSecret}",
                    "audience": "{baseUrl}",
                    "grant_type": "client_credentials"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "200",
            "content": {
              "application/json": {
                "examples": {
                  "Example": {
                    "value": {
                      "access_token": "1234567890",
                      "expires_at": 1767225600,
                      "expires_in": 3600,
                      "scope": "YOUR_GRANTED_SCOPES",
                      "token_type": "Bearer"
                    }
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {
                    "access_token": {
                      "type": "string",
                      "example": "1234567890"
                    },
                    "expires_at": {
                      "type": "integer",
                      "example": 1767225600,
                      "default": 0
                    },
                    "expires_in": {
                      "type": "integer",
                      "example": 3600,
                      "default": 0
                    },
                    "scope": {
                      "type": "string",
                      "example": "YOUR_GRANTED_SCOPES"
                    },
                    "token_type": {
                      "type": "string",
                      "example": "Bearer"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "401",
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{\n    \"error\": \"access_denied\",\n    \"error_description\": \"Unauthorized\"\n}"
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {
                    "error": {
                      "type": "string",
                      "example": "access_denied"
                    },
                    "error_description": {
                      "type": "string",
                      "example": "Unauthorized"
                    }
                  }
                }
              }
            }
          }
        },
        "deprecated": false,
        "security": []
      }
    }
  },
  "x-readme": {
    "explorer-enabled": true,
    "proxy-enabled": true
  }
}
```