> ## Documentation Index > Fetch the complete documentation index at: https://developers.cubbo.com/llms.txt > Use this file to discover all available pages before exploring further. # Obtain an access token > Exchanges your API credential (`client_id` and `client_secret`) for a Bearer token that every other endpoint of this API requires in the `Authorization: Bearer ` header. Tokens are valid for `expires_in` seconds (24 hours by default). Request one token and reuse it until it expires; do not request a new token on every call. - Only the `client_credentials` grant is supported. - Rate limit: 60 requests per minute per `client_id` on this endpoint. Exceeding it returns HTTP 429 with a `Retry-After` header. Every other `/v1` endpoint shares a separate limit of 600 requests per minute per API account. - Store-scoped endpoints (`PATCH /store`, `POST /store/fiscal-account`, `POST /store/digital-certificate`) derive the store from the credential used to obtain the token, so authenticate with the credential of the store you want to configure. ## OpenAPI ````yaml /openapi.yaml post /auth/token openapi: 3.1.0 info: title: Cubbo Clients API version: '1.0' summary: >- Orders, inventory, replenishments, returns, shipping and webhooks for Cubbo fulfillment. description: > The Cubbo Clients API connects your store, ERP or marketplace with Cubbo's fulfillment network. All endpoints except `POST /auth/token` require a bearer token; see the Authentication guide. Request and response bodies are JSON. Errors are JSON objects with an `error` key. contact: name: Cubbo integrations email: integraciones@cubbo.com servers: - url: https://api.cubbo.com/v1 description: Production security: - bearerAuth: [] tags: - name: Authentication description: Exchange client credentials for a bearer token. - name: Orders description: Create, update, hold, cancel and read sales orders. - name: Shipping labels description: Read the shipping labels generated for an order. - name: Inventory description: Products and stock per store. - name: Lots description: Lot-level inventory for products with expiration or batch tracking. - name: Reports description: Bulk reports for reconciliation. - name: Replenishments description: Inbound shipments to the warehouse. - name: Returns description: Returns and exchanges. - name: Stores description: Store provisioning and settings. - name: Shipping methods description: Available shipping methods, coverage and quotes. - name: Click and collect description: Pickup points and in-store pickup orders. paths: /auth/token: post: tags: - Authentication summary: Obtain an access token description: > Exchanges your API credential (`client_id` and `client_secret`) for a Bearer token that every other endpoint of this API requires in the `Authorization: Bearer ` header. Tokens are valid for `expires_in` seconds (24 hours by default). Request one token and reuse it until it expires; do not request a new token on every call. - Only the `client_credentials` grant is supported. - Rate limit: 60 requests per minute per `client_id` on this endpoint. Exceeding it returns HTTP 429 with a `Retry-After` header. Every other `/v1` endpoint shares a separate limit of 600 requests per minute per API account. - Store-scoped endpoints (`PATCH /store`, `POST /store/fiscal-account`, `POST /store/digital-certificate`) derive the store from the credential used to obtain the token, so authenticate with the credential of the store you want to configure. operationId: createAuthToken requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthTokenRequest' example: client_id: 0f1e2d3c-0000-4000-8000-000000001234 client_secret: expires_in: 86400 grant_type: client_credentials responses: '201': description: Token issued content: application/json: schema: $ref: '#/components/schemas/AuthTokenResponse' example: token: expires_in: 86400 type: Bearer '400': description: The request body is not valid JSON content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Error occurred while parsing request parameters '401': description: The credential pair is unknown or the secret does not match content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' example: error: Unauthorized message: invalid credentials '422': description: Validation error content: application/json: schema: $ref: '#/components/schemas/Error' examples: missingClientId: value: error: Parameter client_id is required missingClientSecret: value: error: Parameter client_secret is required expiresInOutOfRange: value: error: Parameter expires_in cannot be greater than 86400 unsupportedGrantType: value: error: Parameter grant_type must be within ["client_credentials"] '429': description: More than 60 token requests in one minute for this `client_id` headers: Retry-After: description: >- Seconds to wait before retrying (the length of the throttle window, 60) schema: type: integer example: 60 content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Too many requests. Please slow down and try again later. '500': $ref: '#/components/responses/InternalServerError' security: [] components: schemas: AuthTokenRequest: type: object required: - client_id - client_secret properties: client_id: type: string description: Identifier of your API credential example: 0f1e2d3c-0000-4000-8000-000000001234 client_secret: type: string description: Secret of your API credential example: expires_in: type: integer description: Token lifetime in seconds minimum: 10 maximum: 86400 default: 86400 example: 86400 grant_type: type: string description: OAuth grant type; only `client_credentials` is supported enum: - client_credentials default: client_credentials example: client_credentials AuthTokenResponse: type: object required: - token - expires_in - type properties: token: type: string description: Bearer token to send in the `Authorization` header example: expires_in: type: integer description: Lifetime of the token in seconds, as requested example: 86400 type: type: string description: Token type; always `Bearer` example: Bearer Error: type: object description: Error body returned by every failed request. required: - error properties: error: type: string description: >- Human-readable description of the failure. For `401` responses it is always `Unauthorized`. example: Parameter store_id is required message: type: string description: >- Present on `401` responses only; the reason the request was rejected. example: invalid token code: type: - string - 'null' description: >- Stable machine-readable code, present on some order, return and replenishment errors. example: ORDER_ALREADY_EXISTS context: type: - object - 'null' description: >- Extra data about the failure when available, for example the id of the conflicting order. additionalProperties: true example: order_id: 987654 UnauthorizedError: type: object description: Body of every 401 response properties: error: type: string description: Always `Unauthorized` example: Unauthorized message: type: string description: Why the request was refused example: invalid token required: - error - message responses: InternalServerError: description: >- Unexpected error. Retry with backoff; if it persists, send the timestamp to Cubbo support. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: 'unexpected error, timestamp: 1760000000' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Token returned by `POST /auth/token`, sent as `Authorization: Bearer `. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.