> ## Documentation Index > Fetch the complete documentation index at: https://developer.finogates.com/llms.txt > Use this file to discover all available pages before exploring further. # Exchange Client Token > Log your app in and get an **access token**. You need this token before you can call any other endpoint — send it with every request to prove who you are. ### What you send The two values you were given when your account was set up: - ``client_id`` — your app's public ID - ``client_secret`` — your app's secret password (keep it private and safe) ### What you get back A long-lived access token. By default the token **does not expire** — the same Bearer value keeps working until you rotate the issuing ``client_secret``. This matches the way Stripe Connect OAuth2 access tokens behave. If you need a token to stop working, rotate the ``client_secret`` from the developer panel. All tokens previously issued for that client become invalid immediately on the next request. Operators who prefer a strict TTL can override by setting the ``CLIENT_ACCESS_TOKEN_EXPIRE_MINUTES`` environment variable to a positive number of minutes on the deployment. ### Good to know - This is the only endpoint that does **not** need a token already — it is how you get one in the first place. - Test mode and live mode are kept separate. The web address you call decides which one you get (the test address or the live address), and your credentials must match that mode. - If you gave us a list of allowed IP addresses, requests coming from any other address are turned away. - Too many failed login attempts in a short time can block you for a while. - The response's ``expires_in`` field is ``null`` when the token has no expiry, and an integer count of seconds otherwise. ## OpenAPI ````yaml POST /v1/platform/auth/token openapi: 3.1.0 info: title: Finogate Platform API v1 version: 0.1.0 servers: - url: https://api-sandbox.finogates.com description: Sandbox - url: https://api.finogates.com description: Production security: [] tags: - name: auth - name: users - name: payees - name: verification - name: bank accounts - name: card processing - name: digital-assets - name: international - name: onboarding - name: pending-applications - name: wallets - name: payments - name: catalog - name: webhooks - name: phone-numbers - name: sms - name: calls - name: listings - name: embed-tokens paths: /v1/platform/auth/token: post: tags: - auth summary: Get an Access Token description: >- Log your app in and get an **access token**. You need this token before you can call any other endpoint — send it with every request to prove who you are. ### What you send The two values you were given when your account was set up: - ``client_id`` — your app's public ID - ``client_secret`` — your app's secret password (keep it private and safe) ### What you get back A long-lived access token. By default the token **does not expire** — the same Bearer value keeps working until you rotate the issuing ``client_secret``. This matches the way Stripe Connect OAuth2 access tokens behave. If you need a token to stop working, rotate the ``client_secret`` from the developer panel. All tokens previously issued for that client become invalid immediately on the next request. Operators who prefer a strict TTL can override by setting the ``CLIENT_ACCESS_TOKEN_EXPIRE_MINUTES`` environment variable to a positive number of minutes on the deployment. ### Good to know - This is the only endpoint that does **not** need a token already — it is how you get one in the first place. - Test mode and live mode are kept separate. The web address you call decides which one you get (the test address or the live address), and your credentials must match that mode. - If you gave us a list of allowed IP addresses, requests coming from any other address are turned away. - Too many failed login attempts in a short time can block you for a while. - The response's ``expires_in`` field is ``null`` when the token has no expiry, and an integer count of seconds otherwise. operationId: exchange_client_token_v1_platform_auth_token_post requestBody: content: application/json: schema: $ref: '#/components/schemas/ClientTokenRequest' required: true responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/CommonResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: ClientTokenRequest: properties: client_id: type: string maxLength: 120 minLength: 5 title: Client Id description: Client identifier issued during onboarding. examples: - cl_aBcDeFgHiJkLmNoPqRsTuV client_secret: type: string maxLength: 255 minLength: 10 title: Client Secret description: >- Client secret issued during onboarding. Shown only once at creation or rotation. examples: - sk_aBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPqRsTuVwXyZ type: object required: - client_id - client_secret title: ClientTokenRequest description: OAuth2 client-credentials token exchange request. CommonResponse: properties: status_code: type: integer title: Status Code description: HTTP status code for the response. data: title: Data description: Payload or error details. query_generated_time: type: integer title: Query Generated Time description: >- UTC timestamp (milliseconds since epoch) when response was generated. type: object required: - status_code - data - query_generated_time title: CommonResponse description: |- Standard response wrapper for single-object responses and errors. Generic over the payload type. A route that declares ``CommonResponse[SomeModel]`` gets the real ``data`` schema rendered in OpenAPI/Swagger; a bare ``CommonResponse`` leaves ``data`` untyped. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError ````