Get access token

Exchanges your client credentials for an access token. First call in any integration, and the one your scheduled job repeats every hour.

Request

Form-encoded body, four fields:

• grant_type(string): always client_credentials.
• client_id(string): your client, in the form <Customer>-<ENV>-ticketinghub-client.
• client_secret(string): the secret provisioned to you.
• scope(string): always ticketinghub-api.

Response

• access_token (string): send this as Authorization: Bearer <access_token> on every subsequent request.
• expires_in (integer): lifetime in seconds. Currently 3600.
• token_type (string): Bearer.
• scope (string): the granted scope, ticketinghub-api.

Notes

Cache the token for its lifetime. An hour is longer than most extracts take, so one token usually covers a whole load; requesting a fresh one per page is needless load on the identity server and slows the extract down.

The token must carry no subject. A user token is rejected by the data API with 403 even when the scope is correct. The client_credentials grant produces a subject-less token by definition, so following this flow is all it takes.

The token endpoint is IdentityServer's own host, not the API base URL — the data feed is published through the gateway, the token flow is not.

If a long extract outlives its token, treat a single 401 as the signal to fetch a new one and retry the same page — see Building the extract.