> For the complete documentation index, see [llms.txt](https://docs.high-mobility.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.high-mobility.com/docs/oauth-2.0.md).

# OAuth 2.0

Our [OAuth 2.0 API](https://www.oauth.com/) with the `client_credentials` grant type allows you to create access tokens to manage your application resources. It's also possible for fleet solutions to use the REST API to retrieve vehicle data for any of their fleet vehicles. You can use the access tokens to authenticate with any of the following services:

* [Data API](/api-references/data/vehicle-data/data-api.md)
* [Eligibility](/api-references/fleet-management/eligibility.md)
* [Static Data API](/docs/vehicle-data/static-data-api.md)
* [Broken mention](broken://spaces/GqovsBFw7seb5vTEwucj/pages/e3dc80cb7ed2c3f7524aacc7a422fc0e05f7b4a4)

We offer two different alternatives for creating an access token, both compliant with the OAuth2 standard. 

* The first one is to use [client credentials grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4) by authenticating with your Client ID and Client Secret.
* As a second option, you can use [assertions for client authentication](https://datatracker.ietf.org/doc/html/rfc7521#section-4.2) by generating private keys within our console and use your private key to authenticate using JWTs. 

You can choose the option that best fits your system design and software architecture.

### Client ID & Client Secret

In order to get an access token, head to your application "OAUTH CLIENT" section in the console and copy the `client_id` and `client_secret`. Next you can make an API call to create a an access token:

```bash
curl --location 'https://sandbox.api.high-mobility.com/v1/access_tokens' \
--header 'Content-Type: application/json' \
--data '{"client_id": "a92cf969-e8ff-4ad4-a45f-42930edde12d", "client_secret": "xfVxR6xnlbeVHXkQatRx4FmxSJxFR0-M", "grant_type": "client_credentials"}'
{
    "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTgwNzAwMDEsImlhdCI6MTY5ODA2OTcwMSwiaXNzIjoiaHR0cHM6Ly9zYW5kYm94LmFwaS5oaWdoLW1vYmlsaXR5LmNvbS92MS9hdXRoX3Rva2VucyIsInNjb3BlIjoiZmxlZXQ6Y2xlYXJhbmNlIHZlaGljbGU6ZWxpZ2liaWxpdHktY2hlY2sgdmVoaWNsZTpkYXRhIiwic3ViIjoiMjEwZmMyOTUtZDQ5OS00ZDgwLTk5MWUtZTQ3NTZlZDI3YTZmIiwidmVyIjoxfQ.2neMW6LioKvZYlbSTf-W4GwSHQmMr_8cyXfhyi4XJF-6F4HrvFNIsLlNUa93wp6BiJ_XEythR8DfWh0PrIaHrg",
    "expires_in": 300,
    "scope": "fleet:clearance vehicle:eligibility-check vehicle:data",
    "token_type": "bearer"
}

```

In this example you can see how the access token is included as the authorization bearer for retrieving the eligibility state of a vehicle.

```bash
curl --location 'https://sandbox.api.high-mobility.com//v1/eligibility' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTgwNzAwMDEsImlhdCI6MTY5ODA2OTcwMSwiaXNzIjoiaHR0cHM6Ly9zYW5kYm94LmFwaS5oaWdoLW1vYmlsaXR5LmNvbS92MS9hdXRoX3Rva2VucyIsInNjb3BlIjoiZmxlZXQ6Y2xlYXJhbmNlIHZlaGljbGU6ZWxpZ2liaWxpdHktY2hlY2sgdmVoaWNsZTpkYXRhIiwic3ViIjoiMjEwZmMyOTUtZDQ5OS00ZDgwLTk5MWUtZTQ3NTZlZDI3YTZmIiwidmVyIjoxfQ.2neMW6LioKvZYlbSTf-W4GwSHQmMr_8cyXfhyi4XJF-6F4HrvFNIsLlNUa93wp6BiJ_XEythR8DfWh0PrIaHrg' \
--data '{
  "vin": "2HM00000000000001",
  "brand": "sandbox"
}'
{
    "data_delivery": [
        "pull",
        "push"
    ],
    "eligible": true,
    "vin": "2HM00000000000001"
}

```

The access token is valid for 5 minutes and can be used for any of the endpoints that are listed as the scope. The Token URI is listed in your application page in the console and differs between our sandbox and live data environments.

### JWT-Based Client Assertion

In this type of authenticaion supports client auth using JWT assertions signed with asymmetric key pairs.

{% hint style="info" %}
**WHEN TO USE?**

While we recommand to use `client_id` and `client_secret` to authenticate, in some circumstances based on your requirements and internal policies you might want to use this approach.
{% endhint %}

The steps are as followed:

1. Create a "OAuth Client Credentials" in the console for your application
2. Sign a JWT with the required claims
3. Call the `/v1/access_tokens` endpoint to get an access token. The parameter `client_assertion_type` must be included and set to `urn:ietf:params:oauth:client-assertion-type:jwtbearer` .
4. Use the `access_token` value in the subsequent API calls.

The following snippet shows an example of how a JWT is generated using the private key, and how the access token is used for authentication in a subsequent API request.

```javascript
const jwt = require("jsonwebtoken")
const uuid4 = require('uuid4')
const request = require("request-promise");

var config = { client_id: "my-client-id", "inserted_at": "2020-06-22T09:38:09", "private_key": "-----BEGIN PRIVATE KEY-----\n....\n-----END PRIVATE KEY-----", "id": "f6c331c4-9271-4e3b-a8c4-6a2cacac6451" }


function get_jwt_token() {
  var payload = {
    ver: 2,
    iss: config.id,
    aud: "https://sandbox.api.high-mobility.com/v1",
    jti: uuid4(),
    iat: Math.round(Date.now() / 1000),
  }

  const private_key = Buffer.from(config.private_key, 'utf8')
  return jwt.sign(payload, private_key, { algorithm: 'ES256' })
}


async function get_client_credentials_access_token(client_assertion) {
  const response = await request.post({
    url: 'https://sandbox.api.high-mobility.com/v1/access_tokens',
    json: {
      client_assertion: client_assertion,
      grant_type: "client_credentials",
      "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
    }
  })
  return response
}

async function get_eligibility_check(access_token) {
  const response = await request.post({
    url: 'https://sandbox.api.high-mobility.com//v1/eligibility',
    headers: {
      "Authorization": `Bearer ${access_token}`,
      "Content-Type": "application/json"
    },
    json: {
      vin: "2HM00000000000001",
      brand: "sandbox"
    },
  })

  return response
}

async function main() {
  try {
    const client_assertion = get_jwt_token()
    const access_token_response = await get_client_credentials_access_token(client_assertion)
    const eligibility_response = await get_eligibility_check(access_token_response.access_token)
    console.log(eligibility_response)
    console.log("Done")
  } catch (err) {
    console.error("Error in main:", err);
  }
}

main();


```

### OpenAPI Specification

You can see all endpoint specifications on the [OpenAPI Reference](/api-references/auth/oauth2.md) page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.high-mobility.com/docs/oauth-2.0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.