Skip to content
flinkeyflinkey for Developers

Get token

POST
/oauth2/token
curl --request POST \
  --url https://api-uat.flinkey.de/v3/oauth2/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header 'flinkey-API-Key: <flinkey-API-Key>' \
  --data username=api-manager@example.com \
  --data password=your-password \
  --data grant_type=password

Purpose

Retrieve an OAuth access token for protected flinkey API v3 requests.

The returned access token is used by the partner backend as bearer token when calling protected API operations.

This operation is part of backend authentication.

It must not be called from mobile apps, frontend applications or browser JavaScript.

When to use this operation

Use this operation when the partner backend needs to authenticate against the flinkey API.

Typical situations:

  • backend startup,
  • first protected API request,
  • access token expired,
  • access token missing from backend cache,
  • retry after receiving an authentication-related response from a protected API call.

Validation notes

PROD validation result:

  • POST /oauth2/token with API Manager username, API Manager password and grant_type=password returned 200 OK.
  • The response contained access_token, token_type and expires_in.
  • The UAT validation must confirm the actual wire type of expires_in; clients should safely accept a positive number or numeric string.
  • The returned access token was used successfully as bearer token for the subsequently validated protected API operations.
  • The request did not require an Authorization header or Customer-ID header.
  • This validation was completed before the endpoint-level validation status model was introduced and was reconciled retrospectively in document version 0.15.

Async behavior

Synchronous.

The token is returned directly in the API response.

Webhook result

No.

This operation does not produce a webhook result.

Security notes

Never log:

  • flinkey-API-Key,
  • API Manager username,
  • API Manager password,
  • access token,
  • full request body,
  • full response body if it contains the token.

Use placeholders in documentation, examples, screenshots and AI prompts.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
Customer-ID
string

Customer context is not required for token retrieval

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/x-www-form-urlencoded
object
username
required

API Manager username

string
password
required

API Manager password

string
grant_type
required

Must be password

string
Example
username=api-manager%40example.com&password=your-password&grant_type=password

Responses

Section titled “Responses”

200

Section titled “200”

Access token was created successfully

Media typeapplication/json
object
access_token

Token used as bearer token for protected API v3 requests

string
expires_in
One of:
number
token_type

Token type returned by the authentication endpoint

string
Example
{
  "access_token": "eyJhbGciOiJSUzI1NiJ9.access_token_example",
  "expires_in": 3600,
  "token_type": "Bearer"
}

401

Section titled “401”

Invalid or missing API subscription key / API key

Recommended handling: Check flinkey-API-Key and environment configuration

415

Section titled “415”

Wrong Content-Type

Recommended handling: Send request as application/x-www-form-urlencoded