Try WSO2 Cloud for Free
Sign in

All docs This doc

Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Removing the links as the section it is linking off does not exist.


  1. Combine the consumer key and consumer secret keys in the format consumer-key:consumer-secret and encode the combined string using base64. Encoding to base64 can be done using the URL: 
    Here's an example consumer key and secret combination : wU62DjlyDBnq87GlBwplfqvmAbAa:ksdSdoefDDP7wpaElfqvmjDue.
  2. Access the Token API by using a REST client such as cURL, with the following parameters.
    • The token API URL is
    • payload - "grant_type=password&username=<username>&password=<password>&scope=<scope>". Replace the <username> and <password> values as appropriate. If your email is and the organization key is "johnsorg", then the username is You can find the organization key from the page


      Tip: <scope> is optional.

      You define scopes for your API's resources so that the resource can only be accessed through a token that has been issued for at least the scope belonging to the resource. For example, if a resource has a scope named 'update' and if the token is issued for the scopes 'read' and 'update', then the token is allowed to access the resource. If the token is issued for 'read' only, the request bearing the particular token will be blocked.

    • headers - Authorization: Basic <base64 encoded string>, Content-Type: application/x-www-form-urlencoded. Replace the <base64 encoded string> as appropriate.          

    For example, use the following cURL command to access the Token API. It generates two tokens as an access token and a refresh token. You can use the refresh token at the time a token is renewed.

    Code Block
    curl -k -d "grant_type=password&username=<username>&password=<password>" -H "Authorization: Basic <base64 encoded (consumer key:consumer secret)>" -H "Content-Type: application/x-www-form-urlencoded"

    User access tokens have a fixed expiration time, which is set to 60 minutes by default. When a user access token expires, the user can try regenerating the token as explained in the Renew user tokens section.

Instead of using the Token API, you can generate access tokens from the API Store's UI.