Requesting an access token

Send a POST request to the token endpoint with HTTP Basic authentication.

Required parameters

Parameter	Value	Notes
grant_type	client_credentials	Fixed value
scope	Space-separated list of scopes	Must be a subset of your authorised scopes
audience	https://stgxcis.mobixone.co.za (staging) / https://xcis.mobixone.co.za (production)	Required. Fixed per environment — see warning below

audience is required

You must include audience=https://stgxcis.mobixone.co.za (staging) or audience=https://xcis.mobixone.co.za (production) on every token request — use the value for the environment you are requesting a token from.

If you omit it, the token endpoint will still return a token — but that token will be rejected by the XCIS API. This is the single most common integration mistake. If your token request succeeds but API calls return an audience error, this parameter is missing.

Example request

curl -X POST https://stgoauth.mobixone.co.za/oauth2/token \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "grant_type=client_credentials" \
  -d "scope=content:write" \
  -d "audience=https://stgxcis.mobixone.co.za"

Credentials must be sent using HTTP Basic authentication (the Authorization: Basic ... header, as -u produces above). Sending client_id/client_secret in the request body is not supported.

Example response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjA0YWJhMTc3...",
  "expires_in": 28799,
  "scope": "content:write",
  "token_type": "Bearer"
}

Field	Description
access_token	The token to send on API requests
expires_in	Seconds until expiry (8 hours)
scope	The scopes actually granted
token_type	Always Bearer

No refresh token is issued — this is correct for the client credentials grant. When your token expires, simply request a new one with the same credentials.

Calling the API

Include the access token in the Authorization header:

curl -X POST https://<api-base>/api/v1/service/ci/ \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjA0YWJhMTc3..." \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Reuse the token across calls rather than requesting a new one each time. See Token caching.