> ## Documentation Index
> Fetch the complete documentation index at: https://developer.payrollintegrations.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Authentication Token

> Exchanges client credentials (client ID and client secret) for an access token using HTTP Basic Authentication.

Exchanges client credentials (client ID and client secret) for an access token using HTTP Basic Authentication. The client ID is used as the username and the client secret as the password, encoded as Base64 in the format: Basic base64(clientId:clientSecret).

Authorization is done using the “Basic” format within the “Authorization” header. Assuming client id is “[sean@example.com](mailto:sean@example.com)” and client secret is “MyVeryCoolSecretPleaseDontSteal”, the format of the unencoded string is as follows:

```
sean@example.com:MyVeryCoolSecretPleaseDontSteal
```

Then base64 encode the string (in javascript this is [Window: btoa() method - Web APIs | MDN](https://developer.mozilla.org/en-US/docs/Web/API/Window/btoa "Window: btoa() | MDN")) to get the following:

```
c2VhbkBleGFtcGxlLmNvbTpNeVZlcnlDb29sU2VjcmV0UGxlYXNlRG9udFN0ZWFs
```

This can be done in the browser console with the methods `btoa()` and `atob()` to confirm these values during testing.

```
> btoa('sean@example.com:MyVeryCoolSecretPleaseDontSteal')
'c2VhbkBleGFtcGxlLmNvbTpNeVZlcnlDb29sU2VjcmVOUGxLYXNIRG9udFNOZWFs'
```

```
> atob('c2VhbkBleGFtcG×lLmNvbTpNeVZlcnlDb29sU2VjcmV0UGxlYXNIRG9udFNZWFs')
'sean@example.com:MyVeryCoolSecretPleaseDontSteal'
```


## OpenAPI

````yaml api-reference/openapi.demo.json POST /v1/auth/token
openapi: 3.0.3
info:
  title: Payroll Integrations Public API
  version: 1.0.0
  description: Public API for Payroll Integrations platform
  license:
    name: MIT
servers:
  - url: https://demo1-api.payrollintegrationsdemo.com
    description: Demo
  - url: https://demo2-api.payrollintegrationsdemo.com
    description: Demo
  - url: https://demo3-api.payrollintegrationsdemo.com
    description: Demo
security: []
tags:
  - name: auth
  - name: employer-identifiers
  - name: meta
  - name: payroll-connections
  - name: payroll-platforms
  - name: roles
  - name: users
  - name: webhooks
paths:
  /v1/auth/token:
    post:
      tags:
        - auth
      summary: Generate a new auth token and session for the user
      description: >-
        Exchanges client credentials (client ID and client secret) for an access
        token using HTTP Basic Authentication.
      operationId: post_v1_auth_token
      requestBody:
        description: Client credentials for OAuth2 client credentials flow.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthTokenRequestBody'
            example:
              grantType: client_credentials
      responses:
        '200':
          description: Successfully authenticated and token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
              example:
                accessToken: >-
                  eyJhbGciOiJSUzI1NiIsImtpZCI6Ik1UY3pOVEkyTnpnNU1ERT0ifQ.eyJzdWIiOiI5ZjJhNGJjZC03ZThmLTQ1YWItYjkxMi1hYzNkZWY2NzhhOTAiLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAudXMtd2VzdC0yLmFtYXpvbmF3cy5jb21cL3VzLXdlc3QtMl9TYW1wbGVQb29sIiwiY2xpZW50X2lkIjoiN2g4ajlrMGwxbTJuM280cDVxNnI3czh0OXUiLCJvcmlnaW5fanRpIjoiYjZjN2Q4ZTktZjBhMS00MmIzLThjZDQtZTVmNmE3YjhjOWQwIiwiZXZlbnRfaWQiOiJhNWI2YzdkOC1lOWYwLTQxYTItN2JjMy1kNGU1ZjZhN2I4YzkiLCJ0b2tlbl91c2UiOiJhY2Nlc3MiLCJzY29wZSI6ImF3cy5jb2duaXRvLnNpZ25pbi51c2VyLmFkbWluIiwiYXV0aF90aW1lIjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDAsImlhdCI6MTcwMDAwMDAwMCwianRpIjoiYzFkMmUzZjQtZzVoNi00N2k4LTg5ajAtZGVmZ2gxMjM0aTU2IiwidXNlcm5hbWUiOiJzYW1wbGUtdXNlci03ZjhhOWJjZC0xZTJmLTNnNGgtNWk2ai03azhsOW0wbjFvMnAifQ.VGhpc0lzQVJhbmRvbVNpZ25hdHVyZVRoYXRJc05vdFZhbGlkQW5kU2hvdWxkTm90QmVVc2VkSW5Qcm9kdWN0aW9uRW52aXJvbm1lbnRzVGhpc0lzQU1vY2tFeGFtcGxlRm9yRG9jdW1lbnRhdGlvblB1cnBvc2VzT25seVBsZWFzZUdlbmVyYXRlWW91ck93blJlYWxUb2tlbkZyb21Db2duaXRvSW5Qcm9kdWN0aW9uRW52aXJvbm1lbnRzTm90VGhpc0V4YW1wbGU
                expiresIn: 900
                tokenType: Bearer
                access_token: >-
                  eyJhbGciOiJSUzI1NiIsImtpZCI6Ik1UY3pOVEkyTnpnNU1ERT0ifQ.eyJzdWIiOiI5ZjJhNGJjZC03ZThmLTQ1YWItYjkxMi1hYzNkZWY2NzhhOTAiLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAudXMtd2VzdC0yLmFtYXpvbmF3cy5jb21cL3VzLXdlc3QtMl9TYW1wbGVQb29sIiwiY2xpZW50X2lkIjoiN2g4ajlrMGwxbTJuM280cDVxNnI3czh0OXUiLCJvcmlnaW5fanRpIjoiYjZjN2Q4ZTktZjBhMS00MmIzLThjZDQtZTVmNmE3YjhjOWQwIiwiZXZlbnRfaWQiOiJhNWI2YzdkOC1lOWYwLTQxYTItN2JjMy1kNGU1ZjZhN2I4YzkiLCJ0b2tlbl91c2UiOiJhY2Nlc3MiLCJzY29wZSI6ImF3cy5jb2duaXRvLnNpZ25pbi51c2VyLmFkbWluIiwiYXV0aF90aW1lIjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwMDM2MDAsImlhdCI6MTcwMDAwMDAwMCwianRpIjoiYzFkMmUzZjQtZzVoNi00N2k4LTg5ajAtZGVmZ2gxMjM0aTU2IiwidXNlcm5hbWUiOiJzYW1wbGUtdXNlci03ZjhhOWJjZC0xZTJmLTNnNGgtNWk2ai03azhsOW0wbjFvMnAifQ.VGhpc0lzQVJhbmRvbVNpZ25hdHVyZVRoYXRJc05vdFZhbGlkQW5kU2hvdWxkTm90QmVVc2VkSW5Qcm9kdWN0aW9uRW52aXJvbm1lbnRzVGhpc0lzQU1vY2tFeGFtcGxlRm9yRG9jdW1lbnRhdGlvblB1cnBvc2VzT25seVBsZWFzZUdlbmVyYXRlWW91ck93blJlYWxUb2tlbkZyb21Db2duaXRvSW5Qcm9kdWN0aW9uRW52aXJvbm1lbnRzTm90VGhpc0V4YW1wbGU
                expires_in: 900
                token_type: Bearer
        '400':
          description: Invalid or unsupported grant type in request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Invalid credentials or malformed authorization header
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          headers:
            WWW-Authenticate:
              schema:
                description: Authentication challenge (Basic)
                type: string
              description: Authentication challenge (Basic)
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          headers:
            Retry-After:
              schema:
                description: Number of seconds to wait before retrying
                type: string
              description: Number of seconds to wait before retrying
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - basicAuth: []
components:
  schemas:
    AuthTokenRequestBody:
      anyOf:
        - type: object
          properties:
            grantType:
              description: OAuth2 grant type
              type: string
              enum:
                - client_credentials
          required:
            - grantType
        - description: >-
            Form-encoded client credentials (the properties can be in any
            order):
            client_id=...&client_secret=...&grant_type=client_credentials
          type: string
          pattern: >-
            ^(?=(?:.*&)?client_id=[^&\s]+(?:&|$))(?=(?:.*&)?client_secret=[^&\s]+(?:&|$))(?=(?:.*&)?grant_type=client_credentials(?:&|$))(?:client_id|client_secret|grant_type)=[^&\s]+(?:&(?:client_id|client_secret|grant_type)=[^&\s]+){2}$
    AuthResponse:
      type: object
      properties:
        accessToken:
          description: JWT access token
          type: string
        expiresIn:
          description: >-
            Token expiration time in seconds. Currently all tokens generated
            last 15 minutes.
          type: number
        tokenType:
          description: Type of the token
          type: string
          enum:
            - Bearer
        access_token:
          description: JWT access token
          type: string
        expires_in:
          description: >-
            Token expiration time in seconds. Currently all tokens generated
            last 15 minutes.
          type: number
        token_type:
          description: Type of the token
          type: string
          enum:
            - Bearer
      required:
        - accessToken
        - expiresIn
        - tokenType
        - access_token
        - expires_in
        - token_type
      additionalProperties: false
    ErrorResponse:
      type: object
      properties:
        message:
          description: Human-readable error message
          type: string
        errors:
          description: Array of specific error details
          type: array
          items:
            type: string
      required:
        - message
        - errors
      additionalProperties: false
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: >-
        HTTP Basic authentication for the token endpoint. Use the client ID as
        the username and the client secret as the password.

````