> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyrisma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an API key for an access token



## OpenAPI

````yaml /api/partner-api/provisioning.json post /v1/auth/client-token
openapi: 3.1.1
info:
  title: 'Cyrisma New Partner API: Provisioning'
  version: v1
servers:
  - url: https://{instance}.cyrisma.com/ta
    description: Tenant Authority, served under the partner's own CYRISMA instance host.
    variables:
      instance:
        default: ccnnnnnn
        description: The instance label of the tenant host issued to the partner.
security:
  - bearerAuth: []
tags:
  - name: Auth
  - name: MSP Administration
paths:
  /v1/auth/client-token:
    post:
      tags:
        - Auth
      summary: Exchange an API key for an access token
      operationId: CreateMachineClientTokenV1
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineClientTokenRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineClientTokenResponse'
        '401':
          description: Unauthorized
components:
  schemas:
    MachineClientTokenRequest:
      required:
        - client_id
        - client_secret
        - requested_scopes
      type: object
      properties:
        client_id:
          type:
            - 'null'
            - string
        client_secret:
          type:
            - 'null'
            - string
        requested_scopes:
          type:
            - 'null'
            - array
          items:
            type: string
    MachineClientTokenResponse:
      required:
        - access_token
        - token_type
        - expires_in
        - expires_at
        - subject_type
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
            - integer
            - string
          format: int32
        expires_at:
          type: string
          format: date-time
        subject_type:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      description: >-
        A machine-client token from POST /v1/auth/client-token. Provisioning and
        user management need the pulse.write scope; reads need pulse.read.
      scheme: bearer
      bearerFormat: JWT

````