> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bahnexpress.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an access token

> Exchanges a client ID and client secret for a bearer token.
The token is valid for 15 minutes and has no refresh token.




## OpenAPI

````yaml /openapi.yaml post /oauth2/token
openapi: 3.1.2
info:
  title: Bahn Customer API
  version: 2.0.0-draft
  summary: Create and follow vehicle transport orders.
  description: |
    Create vehicle transport orders and read their current state.
  contact:
    name: Bahn API support
    email: support@bahnexpress.com
  license:
    name: Proprietary
    identifier: LicenseRef-Proprietary
servers:
  - url: https://sandbox.api.bahnexpress.fi
    description: Customer sandbox
  - url: https://api.bahnexpress.fi
    description: Production
security:
  - oauth2:
      - orders:read
      - orders:write
tags:
  - name: Authentication
    description: Create an access token for the selected environment.
  - name: Prices
    description: Check the current price for a route.
  - name: Orders
    description: Create, read, change, and cancel orders.
  - name: Files
    description: Upload and read order files.
  - name: Inspections
    description: Get vehicle inspection reports.
  - name: Tracking
    description: Get the current location for each order item.
  - name: Reports
    description: Get order report rows.
  - name: Sandbox
    description: Apply deterministic scenarios in the customer sandbox.
  - name: Webhooks
    description: Receive order change events from Bahn.
paths:
  /oauth2/token:
    post:
      tags:
        - Authentication
      summary: Create an access token
      description: |
        Exchanges a client ID and client secret for a bearer token.
        The token is valid for 15 minutes and has no refresh token.
      operationId: createAccessToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AccessTokenRequest'
            example:
              grant_type: client_credentials
      responses:
        '200':
          description: The access token is ready.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessTokenResponse'
              example:
                access_token: eyJhbGciOiJSUzI1NiIsImtpZCI6ImV4YW1wbGUifQ.example
                expires_in: 900
                expires_at: 1785417831
                token_type: Bearer
                scope: orders:read orders:write
        '400':
          $ref: '#/components/responses/InvalidTokenRequest'
        '401':
          $ref: '#/components/responses/InvalidClient'
        '413':
          $ref: '#/components/responses/InvalidTokenRequest'
      security:
        - oauthClient: []
components:
  schemas:
    AccessTokenRequest:
      description: OAuth 2.0 client credentials request.
      type: object
      additionalProperties: false
      required:
        - grant_type
      properties:
        grant_type:
          const: client_credentials
          description: The customer API supports only the client_credentials grant.
        scope:
          type: string
          minLength: 1
          description: >-
            Space-separated scopes to request. Omit this field to request all
            assigned scopes.
    AccessTokenResponse:
      description: Short-lived bearer token for customer API requests.
      type: object
      additionalProperties: false
      required:
        - access_token
        - expires_in
        - expires_at
        - token_type
        - scope
      properties:
        access_token:
          type: string
          description: Bearer token to send in the Authorization header.
        expires_in:
          type: integer
          const: 900
          description: Token lifetime in seconds.
        expires_at:
          type: integer
          description: Token expiry as Unix time in seconds.
        token_type:
          const: Bearer
          description: Token type for the Authorization header.
        scope:
          type: string
          description: Space-separated scopes granted to this token.
    OAuthError:
      description: OAuth 2.0 token endpoint error.
      type: object
      additionalProperties: false
      required:
        - error
        - error_description
      properties:
        error:
          type: string
          description: Stable OAuth error code.
        error_description:
          type: string
          description: Human-readable reason for the error.
  responses:
    InvalidTokenRequest:
      description: The token request is not valid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OAuthError'
          example:
            error: invalid_request
            error_description: Use the client_credentials grant and optional scope field.
    InvalidClient:
      description: The client ID or client secret is not valid.
      headers:
        WWW-Authenticate:
          schema:
            type: string
          description: HTTP Basic authentication challenge.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OAuthError'
          example:
            error: invalid_client
            error_description: Use the client ID and client secret with HTTP Basic.
  securitySchemes:
    oauth2:
      type: oauth2
      description: OAuth 2.0 client credentials.
      flows:
        clientCredentials:
          tokenUrl: /oauth2/token
          scopes:
            orders:read: Read customer orders.
            orders:write: Check prices, upload files, and change customer orders.
            reports:read: Read customer order reports.
            test:write: Apply customer sandbox scenarios.
    oauthClient:
      type: http
      scheme: basic
      description: Use the client ID as the username and the client secret as the password.

````