Get an access token

Exchange your client ID and secret with OAuth 2.0 client_credentials. resource is required and must match exactly. Omit mcp for a REST-only integration.

curl --request POST \
  --url https://api.filemark.ca/oauth2/token \
  --user "$FILEMARK_CLIENT_ID:$FILEMARK_CLIENT_SECRET" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "resource=https://api.filemark.ca" \
  --data-urlencode "scope=https://api.filemark.ca/mcp https://api.filemark.ca/clients:read https://api.filemark.ca/entities:read https://api.filemark.ca/tax-years:read"

A successful exchange returns:

{
  "access_token": "<access-token>",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "https://api.filemark.ca/mcp https://api.filemark.ca/clients:read https://api.filemark.ca/entities:read https://api.filemark.ca/tax-years:read"
}

Tokens last up to 15 minutes. This endpoint issues the only token REST and MCP accept.