Skip to main content
Protected requests use a short-lived bearer token. You obtain it from the public token endpoint by exchanging your client credentials.

​
Issue a token

POST /v1/auth/token is public; it does not require a bearer token, the x-zeam-auth header, or the x-association-id header.
​
string
required
Your application’s client ID.
​
string
required
Your application’s client secret.
cURL
Response
​
string
The bearer token. Send it as Authorization: Bearer <accessToken>.
​
string
Always Bearer.
​
integer
Seconds until the token expires.
​
string
The association bound to your application. Send it as the x-association-id header on every protected request.

​
Use a token

Send the token with your application secret and association id on every protected request:
cURL

​
Refresh a token

Tokens are short-lived and there is no refresh token. To refresh, call POST /v1/auth/token again with your client credentials and use the new token.
Cache the token server-side and reuse it until shortly before expiresIn elapses, then request a new one. Re-issuing on every request is unnecessary and may hit rate limits.

​
Errors

The token endpoint can return:
  • 400, the request body is malformed.
  • 401, the client credentials are invalid.
  • 429, too many requests; honor the Retry-After header.
All errors use the RFC 7807 problem format.