# 1. Get OAuth Token – Authentication with DevicePark API

Before you can interact with any of the DevicePark API endpoints, you must first authenticate and retrieve an access token. This token authorizes you to access protected resources within the DevicePark ecosystem. DevicePark uses the OAuth 2.0 protocol with the client credentials grant type, which is suitable for machine-to-machine communication without a user context.

### Step-by-Step Guide

#### 1. Endpoint URL

You will send a POST request to the following endpoint:

```
https://devicepark.testinium.io/uaa/oauth2/token
```

#### 2. Request Headers

Your request must include the following headers:

* **Authorization**: This should include your client credentials in the format `Basic <base64(CLIENT_ID:CLIENT_SECRET)>`.
* **Content-Type**: Set this to `application/x-www-form-urlencoded`.

#### 3. Request Body Parameters

You must send the following parameters in the request body using x-www-form-urlencoded format:

* **grant\_type**: Set this to `client_credentials`.
* **scope**: Set this to `openid`.

Example request body:

```
grant_type=client_credentials
scope=openid
```

#### 4. Example cURL Command

```bash
curl --location --request POST 'https://devicepark.testinium.io/uaa/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--user '<CLIENT_ID>:<CLIENT_SECRET>' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=openid'
```

#### 5. Example Successful Response

If the authentication is successful, the server will respond with a JSON object containing your access token:

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6...",
  "token_type": "bearer",
  "expires_in": 3600
}
```

* **access\_token**: This is the token you must use in the Authorization header for all future API requests.
* **token\_type**: Always set to "bearer".
* **expires\_in**: The number of seconds the token is valid (usually 3600 seconds = 1 hour).

#### 6. Using the Access Token

Once you receive the `access_token`, include it in the header of all your API requests as follows:

```
Authorization: Bearer <ACCESS_TOKEN>
```

### Important Notes

* The token is temporary and will expire after the time specified in `expires_in`. You will need to request a new one after it expires.
* Always keep your `CLIENT_SECRET` confidential and avoid hardcoding it in frontend applications or publicly accessible places.
* If you're building an automated integration, consider setting up a mechanism to refresh your token automatically.
