> ## Documentation Index
> Fetch the complete documentation index at: https://docs.smartmove.eu/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials Flow

> What to know before using our endpoints

Since we do not allow unapproved access to our endpoints, fetching a token from our server is needed. This is realised through [OAuth](https://oauth.net/2/).

<Steps>
  <Step iconType="regular" stepNumber={1} titleSize="p">
    Receive a **client id** and **client secret** from us.
  </Step>

  <Step titleSize="p">
    Use that information to send a request to the following endpoint.

    ```bash Sample Request theme={null}
    curl -X POST "https://api.smartmove.eu/auth/realms/$ASSET_PROVIDER_COUNTRY_CODE-$ASSET_PROVIDER_CODE/protocol/openid-connect/token" \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -H "Accept: application/json" \
      --data "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET"
    ```
  </Step>

  <Step>
    If valid asset provider information and credentials were inserted, then a successful response with the HTTP code **200** should be returned.

    ```json Sample Response theme={null}
    {
        "access_token": "eyJABCDEFG",
        "expires_in": 300,
        "refresh_expires_in": 0,
        "token_type": "Bearer",
        "not-before-policy": 0,
        "scope": "profile email"
    }
    ```
  </Step>

  <Step>
    Afterwards, the value under `access_token` can be used as the bearer token for our provided endpoints.\
    As stated in our API Reference, this token should be used by adding a header with `Authorization` as the key and `Bearer YOUR_TOKEN` as the value.

    <Note>
      The token is only valid for <u>5 minutes</u>, after which another one has to be fetched.
    </Note>
  </Step>
</Steps>