Get M2M Access Token - Stytch Docs

Documentation Index

Fetch the complete documentation index at: /docs/llms.txt

Use this file to discover all available pages before exploring further.

cURL Example

curl --request POST \
  --url https://test.stytch.com/v1/public/project-test-8aed2e54-0266-4793-9b5e-0cc9c56064da/oauth2/token \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "m2m-client-test-d731954d-dab3-4a2b-bdee-07f3ad1be885",
    "client_secret": "NHQhc7ZqsXJVtgmN2MXr1etqsQrGAwJ-iBWNLKY7DzJj",
    "grant_type": "client_credentials"
  }'

Node SDK Example

const stytch = require('stytch');

const client = new stytch.B2BClient({
  project_id: '${projectId}',
  secret: '${secret}',
});

const params = {
  client_id: '${exampleM2MClientID}',
  client_secret: '${exampleM2MClientSecret}',
  scopes: ['read:users', 'write:users'],
};

client.m2m
  .token(params)
  .then((resp) => {
    console.log(resp);
  })
  .catch((err) => {
    console.log(err);
  });

Go SDK Example

package main

import (
  "context"
  "log"

"github.com/stytchauth/stytch-go/v9/stytch/b2b/b2bstytchapi"
  "github.com/stytchauth/stytch-go/v9/stytch/consumer/m2m"
)

func main() {
  client, err := b2bstytchapi.NewClient(
    "${projectId}",
    "${secret}",
  )
  if err != nil {
    log.Fatalf("error instantiating API client %s", err)
  }

resp, err := client.M2M.Token(
    context.Background(),
    &m2m.TokenParams{
      ClientID: "${exampleM2MClientID}",
      ClientSecret: "${exampleM2MClientSecret}",
      Scopes: []string{"read:users", "write:users"},
    },
  )
  if err != nil {
    log.Println(err)
  }

log.Println(resp)
}

Python SDK Example

from stytch import B2BClient

client = B2BClient(
    project_id="${projectId}",
    secret="${secret}",
)

resp = client.m2m.token(
    client_id="${exampleM2MClientID}",
    client_secret="${exampleM2MClientSecret}",
    scopes=["read:users", "write:users"]
)

print(resp)

Ruby SDK Example

require 'stytch'

client = StytchB2B::Client.new(
    project_id: "${projectId}",
    secret: "${secret}"
)

resp = client.m2m.token(
    client_id: "${exampleM2MClientID}",
    client_secret: "${exampleM2MClientSecret}",
    scopes: ["read:users", "write:users"]
)
puts resp

Response Codes

Response Examples

Success:

{
    "status_code": 200,
    "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
    "access_token": "eyJ...",
    "token_type": "bearer",
    "expires_in": 3600
}

Access Denied:

{
  "status_code": 404,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "m2m_client_not_found",
  "error_message": "The m2m client requested could not be found.",
  "error_url": "https://stytch.com/docs/api/errors/404"
}

Rate Limit Exceeded:

{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}

Server Error:

{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}

Token Details

Access tokens are JWTs signed with the project’s JWKS and are valid for one hour after issuance. M2M Access tokens contain a standard set of claims as well as any custom claims generated from templates.

M2M Access tokens can be validated locally using the Authenticate M2M Access Token method in the Stytch Backend SDKs, or with any library that supports JWT signature validation. Here is an example of a standard set of claims from an M2M Access Token:

{
  "sub": "m2m-client-test-d731954d-dab3-4a2b-bdee-07f3ad1be885",
  "iss": "stytch.com/PROJECT_ID",
  "aud": ["PROJECT_ID"],
  "scope": "read:users write:users",
  "iat": 4102473300,
  "nbf": 4102473300,
  "exp": 4102476900
}

Unlike other Stytch API endpoints, this endpoint is not authenticated with a project_id and project_secret pair. Instead, it is authenticated via the client_id and client_secret of an active M2M Client within the current project.

Endpoint Parameters

Response fields