> This page is for Developers.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Create an OAuth token

POST https://rest.test.zuora.com/oauth/token
Content-Type: application/x-www-form-urlencoded

Creates a bearer token that enables an OAuth client to authenticate with the Zuora REST API. The OAuth client must have been created using the Zuora UI. See [Authentication](https://developer.zuora.com/rest-api/general-concepts/authentication/) for more information.

**Note:** When using this operation, do not set any authentication headers such as `Authorization`, `apiAccessKeyId`, or `apiSecretAccessKey`.

You should not use this operation to generate a large number of bearer tokens in a short period of time; each token should be used until it expires. If you receive a 429 Too Many Requests response when using this operation, reduce the frequency of requests. This endpoint is rate limited by IP address.

For the rate limit information of authentication, see [Rate and concurrent request limits](https://developer.zuora.com/rest-api/general-concepts/rate-concurrency-limits/).


Reference: https://zuora.ferndocs.com/developers/api-reference/zuora-api/authentication/o-auth/create-token

## Servers

- `https://rest.test.zuora.com` (US Developer & Central Sandbox (incl. Test Drive), default)
- `https://rest.sandbox.na.zuora.com` (US API Sandbox Cloud 1)
- `https://rest.apisandbox.zuora.com` (US API Sandbox Cloud 2)
- `https://rest.na.zuora.com` (US Production Cloud 1)
- `https://rest.zuora.com` (US Production Cloud 2)
- `https://rest.test.eu.zuora.com` (EU Developer & Central Sandbox)
- `https://rest.sandbox.eu.zuora.com` (EU API Sandbox)
- `https://rest.eu.zuora.com` (EU Production)
- `https://rest.test.ap.zuora.com` (APAC Developer & Central Sandbox)
- `https://rest.ap.zuora.com` (APAC Production)

## Request

### Headers

- `Zuora-Track-Id` (string, optional) — A custom identifier for tracing the API call. If you set a value for this header, Zuora returns the same value in the response headers. This header enables you to associate your system process identifiers with Zuora API calls, to assist with troubleshooting in the event of an issue. The value of this field must use the US-ASCII character set and must not include any of the following characters: colon (`:`), semicolon (`;`), double quote (`"`), and quote (`'`).
- `Zuora-Entity-Ids` (string, optional) — An entity ID if you have Multi-entity enabled. The value must be a 36-character UUID that contains hyphens(`-`). If your entity ID is not a valid UUID, convert it to a valid UUID before specifying this parameter.

### Body (application/x-www-form-urlencoded)

This endpoint expects an object.

- `client_id` (string, required) — The Client ID of the OAuth client.
- `client_secret` (string, required) — The Client Secret that was displayed when the OAuth client was created.
- `grant_type` (enum, required) — The OAuth grant type that will be used to generate the token. The value of this parameter must be `client_credentials`.
  - Allowed values: `client_credentials`

## Response

### 200

OK

- `access_token` (string, optional) — The generated token.
- `expires_in` (double, optional) — The number of seconds until the token expires.
- `jti` (string, optional) — A globally unique identifier for the token.
- `scope` (string, optional) — A space-delimited list of scopes that the token can be used to access.
- `token_type` (string, optional) — The type of token that was generated, i.e., `bearer`.

## Errors

### 429 Too Many Requests Error

Too Many Requests

- `any`

## Examples

**Request**

```json
{
  "client_id": "string",
  "client_secret": "string",
  "grant_type": "client_credentials"
}
```

**Response**

```json
{
  "access_token": "c652cbc0ea384b9f81856a93a2a74538",
  "expires_in": 3599,
  "jti": "c652cbc0ea384b9f81856a93a2a74539",
  "scope": "user.7c4d5433dc234c369a01b9719ecd059f entity.1a2b7a37-3e7d-4cb3-b0e2-883de9e766cc entity.c92ed977-510c-4c48-9b51-8d5e848671e9 service.echo.read tenant.19",
  "token_type": "bearer"
}
```

**SDK Code**

```python response
import requests

url = "https://rest.test.zuora.com/oauth/token"

payload = ""
headers = {"Content-Type": "application/x-www-form-urlencoded"}

response = requests.post(url, data=payload, headers=headers)

print(response.json())
```

```javascript response
const url = 'https://rest.test.zuora.com/oauth/token';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: new URLSearchParams('')
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go response
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://rest.test.zuora.com/oauth/token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby response
require 'uri'
require 'net/http'

url = URI("https://rest.test.zuora.com/oauth/token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/x-www-form-urlencoded'

response = http.request(request)
puts response.read_body
```

```java response
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://rest.test.zuora.com/oauth/token")
  .header("Content-Type", "application/x-www-form-urlencoded")
  .asString();
```

```php response
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://rest.test.zuora.com/oauth/token', [
  'form_params' => null,
  'headers' => [
    'Content-Type' => 'application/x-www-form-urlencoded',
  ],
]);

echo $response->getBody();
```

```csharp response
using RestSharp;

var client = new RestClient("https://rest.test.zuora.com/oauth/token");
var request = new RestRequest(Method.POST);
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
IRestResponse response = client.Execute(request);
```

```swift response
import Foundation

let headers = ["Content-Type": "application/x-www-form-urlencoded"]

let request = NSMutableURLRequest(url: NSURL(string: "https://rest.test.zuora.com/oauth/token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```