> For the complete documentation index, see [llms.txt](https://docs.gobo.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gobo.io/app-development/get-an-access-token/client-credentials-flow.md).

# Client Credentials Flow

The client credentials flow is used for accessing an API on behalf of your app. This flow should not be used for APIs that require a user context. The client credentials flow can only be initiated once a customeruser has installed your app.

## Obtaining a Token

{% code title="Node.js Client Credentials Flow" lineNumbers="true" %}

```javascript
const axios = require("axios");

const CLIENT_ID = "5d24c3ac-ceae-405d-bf5f-12131fc92dc8";
const CLIENT_SECRET = "gs_...";

const customerorg = "ca7308e0-b666-4a87-8f7e-ec96040750bc";

axios
  .post(
    "https://{marketplace_url}/oauth/token",
    new URLSearchParams({
      grant_type: "client_credentials",
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      target: customerorg,
    }),
    {
      headers: { "Content-Type": "application/x-www-form-urlencoded" },
    }
  })
  .then((response) => console.log(response.data))
  .catch((error) => console.error(error));

```

{% endcode %}

### Request Parameters

| Parameter               | Value                                                                                                                                                                                                                              |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `grant_type`            | `client_credentials`                                                                                                                                                                                                               |
| `client_id`             | Your app's client ID is found in the partner portal.                                                                                                                                                                               |
| `client_secret`         | Your app's client secret is found in the partner portal. *You must keep this secure!*                                                                                                                                              |
| `target` or `target_id` | The unique partnerorg identifier passed as the `target` or `target_id` parameter to your app's installation URL.                                                                                                                   |
| `scope`                 | (optional) A space-delineated list of scopes you are requesting. Gobo will only grant scopes that the app has already approved during installation. Leaving this blank will request all scopes to which the app has been approved. |

### Response

{% code title="Client Credentials Response" %}

```json
{
    "access_token": "eyJhbGci...",
    "expires_in": 28800,
    "token_type": "Bearer",
    "scope": "foo bar"
}
```

{% endcode %}

{% hint style="warning" %}
The client credentials flow should only be used by private clients (e.g. a backend web server) as it exposes the client secret. It should never be used by JavaScript in the browser.
{% endhint %}