> ## Documentation Index > Fetch the complete documentation index at: https://developers.perform.ai/llms.txt > Use this file to discover all available pages before exploring further. # Generate Bearer access token > Generates a Bearer access token using the OAuth 2.0 client credentials flow. Send your Client ID and Client Secret as HTTP Basic authentication and `grant_type=client_credentials` as a form-encoded body. The token is valid for **1 hour** (`expires_in: 3600`). Requesting a new token does not invalidate previously issued tokens — multiple tokens can be valid at the same time, so you can rotate without downtime. Get your Client ID and Client Secret from **Integrations > API** in your account. If no credentials exist yet, select **Request Credentials**. Unlike every other endpoint, the response body of this endpoint does not contain an `api_response` field. ## OpenAPI ````yaml /specs/public-api-v5.yaml post /auth/oauth/token/ openapi: 3.1.0 info: title: Perform.AI Public API (v5) version: 5.0.0 description: |- The Perform.AI Public API lets you create and manage shipments, returns, bookings, tracking events, and documents, and retrieve reference data such as PUDO locations and carrier configurations. All endpoints accept HTTPS connections only and are secured with OAuth 2.0. Generate a Bearer access token with your API credentials (Client ID and Client Secret, from **Integrations > API** in your account), then send it in the `Authorization` header of every request. This specification covers the following endpoints: - `POST /auth/oauth/token/` - `POST /v5/shipment/` - `POST /v5/shipment/update/` - `POST /v5-2-0/shipment/update/` - `GET /v5/shipment/list/` - `GET /v5/shipment/details/` - `GET /v5-2-0/shipment/details/` - `POST /v5/events/create/` - `POST /v5/return/` - `POST /v5/return/update/` - `GET /v5/shipments/documents/` - `GET /v5/shipments/documents/{document_uuid}/` - `GET /v5/shipments/documents/labels/` - `POST /v5/booking/` - `GET /v5/pudo-locations/` - `GET /v5/carrier-configs/` servers: - url: https://api.perform.ai security: - BearerAuth: [] tags: - name: Authentication description: Generate the Bearer access token used by every other endpoint. - name: Shipments description: Create, update, search, and retrieve Shipments. - name: Events description: Add manual tracking events to Shipments. - name: Returns description: Create and update Returns and their Return Shipments. - name: Documents description: Retrieve documents attached to Shipments. - name: Booking description: Book Open Shipments with carriers and provision shipping labels. - name: PUDO locations description: Search pick-up/drop-off locations across your configured carriers. - name: Carrier configurations description: Discover the carriers configured in your account. - name: Webhooks description: Shipment update payloads Perform.AI pushes to your endpoint. paths: /auth/oauth/token/: post: tags: - Authentication summary: Generate Bearer access token description: |- Generates a Bearer access token using the OAuth 2.0 client credentials flow. Send your Client ID and Client Secret as HTTP Basic authentication and `grant_type=client_credentials` as a form-encoded body. The token is valid for **1 hour** (`expires_in: 3600`). Requesting a new token does not invalidate previously issued tokens — multiple tokens can be valid at the same time, so you can rotate without downtime. Get your Client ID and Client Secret from **Integrations > API** in your account. If no credentials exist yet, select **Request Credentials**. Unlike every other endpoint, the response body of this endpoint does not contain an `api_response` field. operationId: post-auth-oauth-token requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object required: - grant_type properties: grant_type: type: string enum: - client_credentials description: OAuth 2.0 grant type. Always `client_credentials`. example: grant_type: client_credentials responses: '200': description: Token generated successfully. content: application/json: schema: type: object required: - access_token - expires_in - token_type properties: access_token: type: string description: >- The Bearer access token. Send it on every other endpoint as `Authorization: Bearer {access_token}`. expires_in: type: integer description: Token lifetime in seconds. Always `3600` (1 hour). token_type: type: string description: Always `Bearer`. example: access_token: >- eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJwYXJjZWxwZXJmb3JtIn0.example expires_in: 3600 token_type: Bearer '403': description: |- Invalid or missing credentials. Check your Client ID and Client Secret under **Integrations > API**, and confirm the Basic authentication header is correctly Base64-encoded. content: application/json: schema: type: object properties: api_response: type: integer description: Always `403` for this error. message: type: string description: Always `Key not authorized`. example: api_response: 403 message: Key not authorized security: - BasicAuth: [] components: securitySchemes: BearerAuth: type: http scheme: bearer description: >- Used by every functional endpoint. Generate the token with `POST /auth/oauth/token/` and send it as `Authorization: Bearer {token}`. BasicAuth: type: http scheme: basic description: >- Used only by the token endpoint. The username is your Client ID and the password is your Client Secret (sent as `Basic base64(client_id:client_secret)`). ````