OAuth2 client-credentials

Exchange an API key + raw secret for a short-lived (1h) Bearer JWT. The JWT then drops into the same Authorization header your subscriber would use the raw key with.

Token endpoint

POST application/x-www-form-urlencoded OR application/json — both work.

POST /v1/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
client_id=<ApiKey.id>            // UUID from the key list page
client_secret=<raw tma_… key>     // the secret revealed once on create / rotate
scope=wallets:read transactions:read   // optional — must be ⊆ key's scopes

Sample curl

curl -X POST https://api.talentos.example/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$API_KEY_ID" \
  -d "client_secret=$API_KEY_RAW" \
  -d "scope=wallets:read transactions:read"

Response

{
  "access_token": "eyJhbGciOiJI…",   // 1-hour JWT signed with JWT_ACCESS_SECRET
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "wallets:read transactions:read"
}

Use the token

Identical to the raw API key path; the JWT just carries the same scopes and tenantId.

curl https://api.talentos.example/v1/wallets \
  -H "Authorization: Bearer eyJhbGciOiJI…"

Scope catalog

Pass any subset of the API key's scopes via the scope form param. Omitting the param defaults to the full set granted to the key.

Loading…

Choosing between raw key and OAuth2

Raw key: simpler — server-to-server, long-lived, single-tenant. Pass directly as Authorization: Bearer tma_… orX-Api-Key.
OAuth2 token: useful when you want short-lived credentials in memory (e.g. browser-side admin tools, ephemeral CI jobs) without ever exposing the raw key. Re-mint hourly.