Help Center/Authentication & API Keys

OAuth 2.0 token exchange

5 min read Updated October 22, 2026

Overview

ComplianceGrid implements the OAuth 2.0 client credentials grant (RFC 6749 section 4.4) for server-to-server use. Sending your API key in x-api-key is simpler and equally valid; use tokens if your platform requires OAuth.

Token endpoint

text

POST /oauth/token
Content-Type: application/x-www-form-urlencoded   (JSON is accepted too)

Parameter	Required	Description
`grant_type`	Yes	`client_credentials`
`client_id`	Yes	The credential's client ID (it must match the key)
`client_secret`	Yes	Your API key (`cg_sk_` or `cg_pk_`)
`scope`	No	Space-separated scopes; defaults to `api`

HTTP Basic authentication (client_id:client_secret) is also accepted.

Example

bash

curl -X POST https://sandbox.api.compliancegrid.ai/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=cg_sk_your_key"

json

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "api",
  "env": "sandbox"
}

Tokens are RS256 JWTs. expires_in is 3600 for production keys and 86400 for sandbox keys. Public keys are at /.well-known/jwks.json.

Errors

400 invalid_request: missing parameters
400 unsupported_grant_type: only client_credentials is supported
401 invalid_client: unknown key, or client_id does not match the key
403 access_denied: the credential is deactivated

Introspection and revocation

bash

curl -X POST https://api.compliancegrid.ai/oauth/introspect -d "token=$CG_TOKEN"   # RFC 7662
curl -X POST https://api.compliancegrid.ai/oauth/revoke     -d "token=$CG_TOKEN"   # always returns 200

Tips

Cache a token until shortly before it expires
Request a new token on a 401 invalid_token
Tokens are bound to one environment

Was this article helpful?