Get an access token

POST/oauth/tokenNo auth required

Exchanges your client_id and client_secret for a bearer token. The prefix on the client id decides whether you get a sandbox or a live token.

Request

Field	Type	Required	Notes
`grant_type`	string	Yes	Must be `client_credentials`
`client_id`	string	Yes	`esf_live_ci_…` or `esf_test_ci_…`
`client_secret`	string	Yes	Shown once, at creation
`scope`	string	No	Space-separated. Narrows the token; cannot widen it

curl -X POST https://partner-api.esimfo.com/oauth/token \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "esf_test_ci_4f9c2a1b8e7d6c5a4b3f2e1d0c9b8a7f",
    "client_secret": "esf_test_cs_xN2pQ7vR...redacted",
    "scope": "catalog:read orders:write"
  }'

Response `200`

Field	Type	Notes
`access_token`	string	Opaque. Do not parse
`token_type`	string	Always `Bearer`
`expires_in`	integer	Seconds — currently 3600
`scope`	string	Scopes actually granted

{
  "access_token": "esf_test_at_9K3mR7pQ2wX5nB8vC1zL4jH6tY0dF...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "catalog:read orders:write"
}

Errors

Status	Code	Cause
401	`invalid_credentials`	Unknown client id, wrong secret, or the key was revoked
429	`rate_limited`	Too many failed attempts for this client id

Rotation, scopes and prefixes are covered in Authentication.