Skip to main content
Before you can use the GBG GO API, you must authenticate your request. This involves exchanging your API client credentials for an access token.

​
What you need

Before requesting an access token, make sure you have created an API client and have the following credentials:
  • Client ID: Identifies your API client.
  • Client secret: A secure key generated when you create the API client.
You create API clients in the Clients tab of the Account management portal. See Manage API clients for instructions.

​
Request an access token

To get your access token, send a POST request to the token endpoint using the client_credentials grant type. You can send a request like this:
BASH
curl --request POST \
  --url https://api.auth.gbgplc.com/as/token.oauth2 \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials' \
  --data 'client_id=your-client-id' \
  --data 'client_secret=your-client-secret' \
  --data 'scope=gbg.token'
If your request is successful, the API will return a response in this format:
JSON
{
  "access_token": "your-access-token",
  "token_type": "Bearer",
  "expires_in": 3600
}
Store your access token securely and refresh it when it expires. Refer to the Generate access token API reference for details on the request and response definitions.

​
FAQ

To authenticate, send a POST request to the token endpoint:
JSON
https://api.auth.gbgplc.com/as/token.oauth2
The request must be sent with the following parameters:
ParameterDescription
grant_typeSet to client_credentials.
client_idThe client ID.
client_secretThe client secret.
scopeSet to gbg.token.
Example request:
BASH
curl --request POST \
  --url https://api.auth.gbgplc.com/as/token.oauth2 \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials' \
  --data 'client_id=your-client-id' \
  --data 'client_secret=your-client-secret' \
  --data 'scope=gbg.token'
A successful response returns:
{
  "access_token": "your-access-token",
  "token_type": "Bearer",
  "expires_in": 3600
}
Include the token in the Authorization header of subsequent API request as Bearer your-access-token. Store the token securely and refresh it before it expires.You create API clients yourself in the Clients tab of the Account management portal, where you generate the client ID and client secret used to authenticate. For details, see Manage API clients in Account management.

​
Next step

Go to Step 2: Start a journey to create a new journey instance.