> ## Documentation Index
> Fetch the complete documentation index at: https://nextgen-docs.enfuce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Enfuce follows the **OAuth 2.0** authorisation method. To access our APIs, you must follow the OAuth 2.0 Client Credentials grant.

## Authorisation Request

Send a request to the Enfuce authorisation server, including your **Client ID** and **Client Secret**:

<div style={{marginLeft: '20px', marginTop: '10px'}}>
  <ul>
    <li>Endpoint: <code>/oauth2/token</code></li>
    <li>Method: <code>POST</code></li>
  </ul>
</div>

<Tabs>
  <Tab title="Curl Example">
    ```bash theme={null}
    curl --location 'https://auth.[TENANT].ext-uat1-sandbox.mycore.enfuce.com/oauth2/token' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --header 'Authorization: Basic <base64(client_id:client_secret)>' \
    --data-urlencode 'grant_type=client_credentials'
    ```
  </Tab>

  <Tab title="HTTP Example">
    ```http theme={null}
    POST /oauth2/token HTTP/1.1
    Host: auth.[TENANT].ext-uat1-sandbox.mycore.enfuce.com
    Content-Type: application/x-www-form-urlencoded
    Authorization: Basic <base64(client_id:client_secret)>

    grant_type=client_credentials
    ```
  </Tab>
</Tabs>

<Note>
  <ul>
    <li>Each Enfuce customer would receive access to two environments — Sandbox/UAT and Production. The client credentials are environment specific.</li>
    <li>Your onboarding manager would share with you the Client ID and the Client Secret.</li>
  </ul>
</Note>

## Authorisation Response

If the request to the Enfuce authorisation server is valid with correct `client_id` and `client_secret`, we return an access token that you must include in the authorisation header of every API request.

```
{

"access_token": "eyJraWQiOiJLT0dOSVRPX1NL...",

"expires_in": 3600,

"token_type": "Bearer"

}

```

* `access_token`: Include this token in the authorisation header of every API request.
* `expires_in`: The validity of the access token in seconds.
* `token_type`: Bearer token

<Info>The access tokens are short-lived — if the token expires, send another request to the Enfuce authorisation server to obtain a new token.</Info>

## Environment Specific URLs Structure

* Sandbox environment: `https://auth.[TENANT].ext-uat1-sandbox.mycore.enfuce.com/oauth2/token`
* Production environment: `https://auth.[TENANT].eu.live.prod.mycore.enfuce.com/oauth2/token`