> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drop-hub.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth 2.0 client-credentials token issuance for machine integrations

> Standard RFC 6749 token endpoint. The client authenticates with HTTP Basic (preferred) or body client_id/client_secret parameters and receives a short-lived signed JWT bearer token. Responses use OAuth error semantics and are never stored.



## OpenAPI

````yaml /openapi.yaml post /oauth/token
openapi: 3.1.0
info:
  title: DropHub External API
  version: v2
  description: >-
    DropHub API v2 for Merchant, shipping-company, shipment, and OAuth 2.0
    integrations.
  contact:
    name: DropHub API Governance
  license:
    name: Proprietary
servers:
  - url: https://api-test.drop-hub.com
    description: Sandbox deployment with isolated data and credentials.
  - url: https://api.drop-hub.com
    description: Production deployment; production credentials only.
security: []
tags:
  - name: Authentication
    description: >-
      Authentication, sessions, the company a principal is, and merchant API
      credentials
  - name: External Price Estimates
    description: OAuth-scoped transient route-distance and tariff calculation
  - name: External Shipments
    description: OAuth-scoped Merchant shipment creation, lookup, and cancellation
  - name: External Tracking
    description: Merchant-authenticated and privacy-minimized public tracking projections
  - name: Sandbox
    description: >-
      Tenant-bound self-service fixture lifecycle, available only on the
      isolated sandbox deployment
  - name: Webhook Endpoints
    description: Merchant webhook subscriptions, lifecycle, and signing-secret rotation
  - name: Webhook Deliveries
    description: Durable webhook delivery history and replay
paths:
  /oauth/token:
    post:
      tags:
        - Authentication
      summary: OAuth 2.0 client-credentials token issuance for machine integrations
      description: >-
        Standard RFC 6749 token endpoint. The client authenticates with HTTP
        Basic (preferred) or body client_id/client_secret parameters and
        receives a short-lived signed JWT bearer token. Responses use OAuth
        error semantics and are never stored.
      operationId: issueOAuthAccessToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              additionalProperties: false
              required:
                - grant_type
              properties:
                grant_type:
                  type: string
                  enum:
                    - client_credentials
                client_id:
                  type: string
                  maxLength: 64
                client_secret:
                  type: string
                  maxLength: 128
      responses:
        '200':
          description: Issued access token
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                required:
                  - access_token
                  - token_type
                  - expires_in
                properties:
                  access_token:
                    type: string
                  token_type:
                    type: string
                    enum:
                      - Bearer
                  expires_in:
                    type: integer
                    format: int64
                    minimum: 60
        '400':
          description: invalid_request or unsupported_grant_type (OAuth JSON error)
        '401':
          description: invalid_client (OAuth JSON error)
        '405':
          $ref: '#/components/responses/MethodNotAllowed'
        '422':
          $ref: '#/components/responses/ValidationFailed'
        '429':
          description: rate_limited (OAuth JSON error with Retry-After)
      security: []
components:
  responses:
    MethodNotAllowed:
      description: The method is not supported for this resource.
      headers:
        Allow:
          description: Methods supported by this resource.
          schema:
            type: string
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    ValidationFailed:
      description: The request fails strict syntax or semantic validation.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
  schemas:
    Problem:
      type: object
      description: RFC 9457 Problem Details with stable DropHub extensions
      additionalProperties: true
      required:
        - type
        - title
        - status
        - code
        - timestamp
        - correlationId
        - requestId
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
          maxLength: 128
        status:
          type: integer
          format: int32
          minimum: 400
          maximum: 599
        detail:
          type: string
          maxLength: 512
        instance:
          type: string
          format: uri-reference
        code:
          type: string
          pattern: ^[A-Z][A-Z0-9_]{1,63}$
        timestamp:
          type: string
          format: date-time
        correlationId:
          type: string
          format: uuid
        requestId:
          type: string
          format: uuid
        traceId:
          type: string
          pattern: ^[0-9a-f]{32}$
        violations:
          type: array
          maxItems: 20
          items:
            $ref: '#/components/schemas/Violation'
      example:
        type: https://api.drop-hub.com/problems/access-denied
        title: Access denied
        status: 403
        detail: Access to this resource is denied.
        instance: /v2/external/shipments/018f2d8a-1f00-7000-8000-000000000206
        code: ACCESS_DENIED
        timestamp: '2026-08-22T18:30:00Z'
        correlationId: 018f2d8a-1f00-7000-8000-000000000207
        requestId: 018f2d8a-1f00-7000-8000-000000000208
    Violation:
      type: object
      additionalProperties: false
      required:
        - field
        - code
        - message
      properties:
        field:
          type: string
          maxLength: 128
        code:
          type: string
          maxLength: 64
        message:
          type: string
          maxLength: 256

````