> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.ipxo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate.

All APIs use Bearer authentication. Before you can call any IPXO API, you need to obtain an ***access token***. This token is used to authenticate and authorize all subsequent API requests.

IPXO APIs use ***OAuth 2.0 Client Credentials*** flow, which is designed for server-to-server integrations (no user interaction required).

## When should I use this?

Use this authentication method when:

* You are building a backend service or automation
* You already have API credentials (client ID + secret)
* You want to access billing, ecommerce, or credits APIs programmatically

## Where do I get API credentials?

To obtain your Client ID and Client Secret:

1. Log in to your IPXO account
2. Open the Integrations page in the portal: 👉 [https://www.ipxo.com/portal/integrations](https://www.ipxo.com/portal/integrations)
3. Click Create App
4. Give your application a name and select the required scopes
5. Save the app

After creation, you will be provided with:

* Client ID
* Client Secret

> 🔐 The Client Secret is shown only once. Make sure to store it securely.

## Prerequisites

Before calling the authentication endpoint, you need:

* ***Client ID*** – created via Portal → Integrations
* ***Client Secret*** – created together with the client ID
* ***Scopes*** – define which APIs your token can access

Example scopes used in the guides:

* `billing`
* `ecommerce`
* `credits`
* `nethub-data`

Scopes must be provided as a ***space-separated list***.

## Generate Access Token

### Request: Get an access token

```bash theme={null}
curl 'https://hydra.ipxo.com/oauth2/token' \
  -X POST \
  -d 'grant_type=client_credentials' \
  -d 'client_id={client_id}' \
  -d 'client_secret={client_secret}' \
  -d 'scope=billing ecommerce credits'
```

### Response

```bash theme={null}
{
  "access_token": "{access_token}",
  "expires_in": 86399,
  "scope": "billing ecommerce credits",
  "token_type": "bearer"
}
```

### Key response fields explained

| Field         | Meaning                                     |
| ------------- | ------------------------------------------- |
| access\_token | Bearer token used to authorize API requests |
| expires\_in   | Token lifetime in seconds (≈ 24 hours)      |
| scope         | APIs this token can access                  |
| token\_type   | Always bearer                               |

### Using the access token

Send the token in the Authorization header for ***all*** API calls:

`Authorization: Bearer {access_token}` Example:

```bash theme={null}
curl 'https://apigw.ipxo.com/ecommerce/public/{tenant_uuid}/cart' \
-H 'Authorization: Bearer {access_token}'
```