> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate UX Toolkit OAuth access token

> Use this endpoint to generate your UX Toolkit OAuth access token.

POST/oauth/token

Use this endpoint to generate your UX Toolkit OAuth access token. For details, see [Customer Authentication API](https://www.marqeta.com/docs/developer-guides/uxt-customer-authentication-api.md).

> [!NOTE]
>
> **Note**\
> Unlike the other UX Toolkit endpoints, this endpoint is served by the dedicated OAuth host rather than by the UX Toolkit API base URLs listed above. Send the request to `https://secure-sandbox.marqeta.com/oauth/token` in sandbox, or to `https://secure.marqeta.com/oauth/token` in production. The `audience` parameter still identifies the UX Toolkit API. To move an existing integration, see [How to migrate UX Toolkit to dedicated OAuth](https://www.marqeta.com/docs/developer-guides/KnowledgeBase/How-to-migrate-to-dedicated-OAuth.md).

## Request header

| Fields | Description |
| - | - |
| Content-Type string  Required | Media type of the request body. **Allowable Values:**  `application/x-www-form-urlencoded` |
| DPoP string  Required | A valid Demonstrating Proof of Possession (DPoP) JSON Web Token (JWT). **Allowable Values:**  Valid DPoP proof JWT |

## Request body

| Fields | Description |
| - | - |
| grant\_type string  Required | Type of OAuth 2.0 grant. Must be set to `client_credentials`. **Allowable Values:**  `client_credentials` |
| client\_assertion\_type string  Required | Indicates the type of JWT-based client assertion for authentication. Must be set to `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. **Allowable Values:**  `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` |
| client\_assertion string  Required | Signed JWT that asserts the client's identity. The header must include the `kid` provided with your client ID. The `aud` claim must be the full token endpoint URL, including the `/oauth/token` path, and the assertion must expire no more than five minutes after it was issued. For more information, see [Create your client assertion token](https://www.marqeta.com/docs/developer-guides/uxt-customer-authentication-api.md#create-your-client-assertion-token). **Allowable Values:**  Valid client assertion |
| user\_token string  Required | Unique identifier of the user account holder. **Allowable Values:**  Existing user token  1-36 chars |
| audience string  Required | Intended audience of the returned access token. This value should match the base URL of the UX Toolkit API. **Allowable Values:**  `<a href="https://ux-toolkit-api-sandbox.marqeta.com">https://ux-toolkit-api-sandbox.marqeta.com</a>`, `<a href="https://ux-toolkit-api.marqeta.com">https://ux-toolkit-api.marqeta.com</a>` |

## Sample request

```sh cURL lines wrap theme={null}
curl --location --request POST 'https://secure-sandbox.marqeta.com/oauth/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header "DPoP: $DPOP_PROOF" \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
  --data-urlencode "client_assertion=$CLIENT_ASSERTION" \
  --data-urlencode 'user_token=some-user-token' \
  --data-urlencode 'audience=https://ux-toolkit-api-sandbox.marqeta.com'
```

## Response body

| Fields | Description |
| - | - |
| access\_token string  Returned | DPoP-bound JWT that must be passed back to UX Toolkit client via your Customer Authentication API. **Allowable Values:**  Valid access token |
| expires\_in number  Returned | Number of seconds for which the returned `access_token` will remain valid. **Allowable Values:**  Any integer |
| token\_type string  Returned | Identifies the token type. For DPoP flows, this value is always `DPoP`. **Allowable Values:**  `DPoP` |

## Sample response body

```json JSON lines wrap theme={null}
{
  "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImRwb3Arand0IiwiandrIjp7Imt0eSI6IkVDIiwieCI6ImdIM3F5X0xRS3Q3NW9Bejg0R0hhRW5IVUdaVzIydjdFdkhPcmEtSUZqTTAiLCJ5IjoieFlDcDVIUjVHbV90UVBQQ0ZyLU1TUUd1TEYtRkhtbWlEaEl4U3g4MUh6TSIsImNydiI6IlAtMjU2In19.eyJhdGgiOiJ6VVdYc3hicmt6MGtlM0pHQm93UzZRYXVCaVZjWDhPeVY2T3lGQURDT05nIiwiaHR1IjoiaHR0cHM6Ly91eC10b29sa2l0LWFwaS1zYW5kYm94Lm1hcnFldGEuY29tL2FwaS92MS9hdXRoL3Byb2dyYW0tc2hvcnQtY29kZSIsImh0bSI6IkdFVCIsImp0aSI6IjgxNjc2YWQxLTM0MmMtNDZhNi05OTg5LWFiMWFlOWZhZGMxMCIsImlhdCI6MTc0ODkwNTczMSwiZXhwIjoxNzQ4OTA1NzkxfQ.fP3s2El6PlBfJUI-Pc98T6GdPTZgKvFmFnWx75QtOdhTXNJz9RVNEcddIK7YHpbubETcrvs6LZm-vAwZ1B7R1g",
  "token_type": "DPoP",
  "expires_in": 3600
}
```


## Related topics

- [UX Toolkit Overview](https://www.marqeta.com/docs/core-api/uxt-sdk.md)
- [Customer Authentication API](https://www.marqeta.com/docs/developer-guides/uxt-customer-authentication-api.md)
- [Generate UX Toolkit authentication token](https://www.marqeta.com/docs/core-api/uxt-sdk/generate-ux-toolkit-authentication-token.md)
- [How to migrate UX Toolkit SDK to dedicated OAuth](https://www.marqeta.com/docs/developer-guides/KnowledgeBase/How-to-migrate-to-dedicated-OAuth.md)
- [Customizing UX Toolkit](https://www.marqeta.com/docs/developer-guides/uxt-customizing-ux-toolkit.md)