curl --request POST \
--url https://oauth2-{dc}.moengage.com/v1/oauth/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=client_credentials \
--data client_id=YOUR_WORKSPACE_ID \
--data client_secret=YOUR_API_KEY{
"access_token": "eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjoiUlN3Q2t6...",
"refresh_token": "550e8400-e29b-41d4-a716-446655440000",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token_expires_in": 86400
}{
"status": "FAILURE",
"error_type": "ER019",
"reason": "client_id is required."
}{
"status": "FAILURE",
"error_type": "ER011",
"reason": "Auth validation failed."
}{
"status": "FAILURE",
"error_type": "<string>",
"reason": "<string>"
}{
"status": "FAILURE",
"error_type": "RATE_LIMIT_EXCEEDED",
"reason": "Too many requests."
}Generate Access Token
Exchange the client_id and client_secret of an OAuth 2.0 API key for an access token and a refresh token.
The client_id is your Workspace ID, and the client_secret is the API key value that the dashboard displays once, when you create the key. The key must have Authentication Type set to OAuth 2.0 on the API key dashboard, or the request fails with ER012.
To create the key, refer to API Key Dashboard. For the end-to-end integration, refer to OAuth 2.0 Overview. To renew an access token without resending your API key, refer to Refresh Access Token.
curl --request POST \
--url https://oauth2-{dc}.moengage.com/v1/oauth/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=client_credentials \
--data client_id=YOUR_WORKSPACE_ID \
--data client_secret=YOUR_API_KEY{
"access_token": "eyJhbGciOiJSUzI1NiJ9.eyJkYXRhIjoiUlN3Q2t6...",
"refresh_token": "550e8400-e29b-41d4-a716-446655440000",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token_expires_in": 86400
}{
"status": "FAILURE",
"error_type": "ER019",
"reason": "client_id is required."
}{
"status": "FAILURE",
"error_type": "ER011",
"reason": "Auth validation failed."
}{
"status": "FAILURE",
"error_type": "<string>",
"reason": "<string>"
}{
"status": "FAILURE",
"error_type": "RATE_LIMIT_EXCEEDED",
"reason": "Too many requests."
}Rate Limit
This endpoint allows 30 requests per 10 minutes and 5 requests per minute. Both limits apply perclient_id and client_secret pair. A 429 response includes a Retry-After header that gives the number of seconds to wait. The same value also appears in the deprecated X-RETRY-AFTER header. Read Retry-After.
Access tokens are reusable for their full lifetime. Generate one access token and reuse the token until the token approaches expiry, instead of calling this endpoint for every API request.
Determine the Token Expiry
Theexpires_in field gives the access token’s lifetime in seconds, counted from the moment MoEngage issues the token. Schedule your refresh from that value. The lifetime reflects the Expiry time (in minutes) set on the API key, which defaults to 15 minutes.
The refresh_token_expires_in field gives the number of seconds until the refresh token expires if you do not use the token. Refresh at least once in that window to keep the refresh token alive.
Send the access token on API requests as Authorization: Bearer <access_token>. For the request format and the authentication error codes, refer to Call the MoEngage Public APIs.Body
The form-encoded credentials for the client credentials grant.
The OAuth 2.0 grant type. The supported value is client_credentials.
client_credentials Your Workspace ID. The API key dashboard displays the Workspace ID at Settings > Account > API keys.
The API key value. The dashboard displays the API key only once, when you create the key.
Response
MoEngage issued an access token and a refresh token. Store both tokens. The refresh token expires after 24 hours without a refresh, and after 30 days at most.
The access token that you send as a Bearer token on your API requests.
The token that you exchange for new access tokens at Refresh Access Token. The refresh token expires after 24 hours without a refresh, and after 30 days at most.
The token type. The value is always Bearer.
"Bearer"
The lifetime of the access token, in seconds. The value reflects the Expiry time (in minutes) set on the API key.
900
The number of seconds until the refresh token expires if you do not use the token. The value is 24 hours, or less when the refresh token approaches its 30-day limit.
86400