--- title: "Authorization" slug: "authorization" updated: 2025-08-19T11:52:12Z published: 2025-08-19T11:52:12Z canonical: "docs.grassfish.com/authorization" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.grassfish.com/llms.txt > Use this file to discover all available pages before exploring further. # Authorization API requests require authorization. You can authorize via OAuth 2.0 client credentials flow. > [!NOTE] > Note > > - If you write your own application/integration, you need to request an API user from your Grassfish contact person. > - We recommend having one specific user per application/integration who has the necessary rights and permissions to use the API. ## What is OAuth 2.0? OAuth 2.0 is an open authorization standard that allows users to grant third-party applications limited access to their resources on another service without sharing their passwords. ## Client credentials flow We support the OAuth 2.0 client credentials flow, which allows applications to obtain an access token by submitting their own client ID and secret to an authorization server, without requiring user interaction or consent. ## Scope The scope needs to be `aquaconnect` when requesting the token. ### Example login Here’s an example of logging in and receiving the bearer token. To use it, replace `<TokenUrl>`, `<ClientId>`, and `<ClientSecret>` with the values provided to you after requesting a user. ```http POST Content-Type: application/x-www-form-urlencoded grant_type=client_credentials &client_id= &client_secret= &scope=aquaconnect ```