openapi: 3.0.1 info: title: Logto API references Account center Sign-in experience API description: 'API references for Logto services. Note: The documentation is for Logto Cloud. If you are using Logto OSS, please refer to the response of `/api/swagger.json` endpoint on your Logto instance.' version: Cloud servers: - url: https://[tenant_id].logto.app/ description: Logto endpoint address. security: - OAuth2: - all tags: - name: Sign-in experience description: Endpoints for customizing Logto sign-in experience. See [🎨 Customize sign-in experience](https://docs.logto.io/docs/recipes/customize-sie/) to learn more about how the configuration works and reflects on the user interface. paths: /api/sign-in-exp: get: operationId: GetSignInExp tags: - Sign-in experience parameters: [] responses: '200': description: Default sign-in experience settings. content: application/json: schema: type: object required: - tenantId - id - color - branding - hideLogtoBranding - languageInfo - termsOfUseUrl - privacyPolicyUrl - agreeToTermsPolicy - signIn - signUp - socialSignIn - socialSignInConnectorTargets - signInMode - customCss - customContent - customUiAssets - passwordPolicy - mfa - adaptiveMfa - singleSignOnEnabled - supportEmail - supportWebsiteUrl - unknownSessionRedirectUrl - captchaPolicy - sentinelPolicy - emailBlocklistPolicy - forgotPasswordMethods - passkeySignIn - signUpProfileFields properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 color: type: object required: - primaryColor - isDarkModeEnabled - darkPrimaryColor properties: primaryColor: type: string format: regex pattern: /^#[\da-f]{3}([\da-f]{3})?$/i isDarkModeEnabled: type: boolean darkPrimaryColor: type: string format: regex pattern: /^#[\da-f]{3}([\da-f]{3})?$/i description: The primary branding color for the sign-in page (both light/dark mode). branding: type: object properties: logoUrl: type: string format: url darkLogoUrl: type: string format: url favicon: type: string format: url darkFavicon: type: string format: url hideLogtoBranding: type: boolean description: Cloud only. Whether to hide the Logto branding on hosted sign-in pages. languageInfo: type: object required: - autoDetect - fallbackLanguage properties: autoDetect: type: boolean fallbackLanguage: type: string enum: - af-ZA - am-ET - ar - ar-AR - as-IN - az-AZ - be-BY - bg-BG - bn-IN - br-FR - bs-BA - ca-ES - cb-IQ - co-FR - cs - cs-CZ - cx-PH - cy-GB - da-DK - de - de-DE - el-GR - en - en-GB - en-US - eo-EO - es - es-ES - es-419 - et-EE - eu-ES - fa-IR - ff-NG - fi - fi-FI - fo-FO - fr - fr-CA - fr-FR - fy-NL - ga-IE - gl-ES - gn-PY - gu-IN - ha-NG - he-IL - hi-IN - hr-HR - ht-HT - hu-HU - hy-AM - id-ID - ik-US - is-IS - it - it-IT - iu-CA - ja - ja-JP - ja-KS - jv-ID - ka-GE - kk-KZ - km-KH - kn-IN - ko - ko-KR - ku-TR - ky-KG - lo-LA - lt-LT - lv-LV - mg-MG - mk-MK - ml-IN - mn-MN - mr-IN - ms-MY - mt-MT - my-MM - nb-NO - ne-NP - nl - nl-BE - nl-NL - nn-NO - or-IN - pa-IN - pl-PL - ps-AF - pt - pt-BR - pt-PT - ro-RO - ru - ru-RU - rw-RW - sc-IT - si-LK - sk-SK - sl-SI - sn-ZW - sq-AL - sr-RS - sv - sv-SE - sw-KE - sy-SY - sz-PL - ta-IN - te-IN - tg-TJ - th - th-TH - tl-PH - tr - tr-TR - tt-RU - tz-MA - uk-UA - ur-PK - uz-UZ - vi-VN - zh - zh-CN - zh-HK - zh-MO - zh-TW - zz-TR description: The language detection policy for the sign-in page. termsOfUseUrl: type: string maxLength: 2048 nullable: true privacyPolicyUrl: type: string maxLength: 2048 nullable: true agreeToTermsPolicy: type: string enum: - Automatic - ManualRegistrationOnly - Manual signIn: type: object required: - methods properties: methods: type: array items: type: object required: - identifier - password - verificationCode - isPasswordPrimary properties: identifier: type: string enum: - username - email - phone password: type: boolean verificationCode: type: boolean isPasswordPrimary: type: boolean description: Sign-in method settings. signUp: type: object required: - identifiers - password - verify properties: identifiers: type: array items: type: string enum: - username - email - phone description: Allowed identifiers when signing-up. password: type: boolean description: Whether the user is required to set a password when signing-up. verify: type: boolean description: Whether the user is required to verify their email/phone when signing-up. secondaryIdentifiers: type: array items: type: object required: - identifier properties: identifier: oneOf: - type: string enum: - username - email - phone - type: string enum: - emailOrPhone verify: type: boolean description: Additional identifiers required during sign-up. Once specified, users will be prompted to provide these identifiers when creating an account. description: Sign-up method settings. socialSignIn: type: object properties: automaticAccountLinking: type: boolean skipRequiredIdentifiers: type: boolean socialSignInConnectorTargets: type: array items: type: string description: Enabled social sign-in connectors, will displayed on the sign-in page. signInMode: type: string enum: - SignIn - Register - SignInAndRegister customCss: type: string nullable: true customContent: type: object additionalProperties: type: string description: Custom content to display on experience flow pages. the page pathname will be the config key, the content will be the config value. customUiAssets: type: object required: - id - createdAt properties: id: type: string createdAt: type: number nullable: true passwordPolicy: type: object properties: length: default: {} type: object required: - min - max properties: min: default: 8 type: number max: default: 256 type: number characterTypes: default: {} type: object required: - min properties: min: default: 1 type: number rejects: default: {} type: object required: - pwned - repetitionAndSequence - userInfo - words properties: pwned: default: true type: boolean repetitionAndSequence: default: true type: boolean userInfo: default: true type: boolean words: default: [] type: array items: type: string description: Password policies to adjust the password strength requirements. mfa: type: object required: - factors - policy properties: factors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode policy: type: string enum: - UserControlled - Mandatory - PromptOnlyAtSignIn - PromptAtSignInAndSignUp - NoPrompt - PromptAtSignInAndSignUpMandatory - PromptOnlyAtSignInMandatory organizationRequiredMfaPolicy: type: string enum: - NoPrompt - Mandatory description: MFA settings adaptiveMfa: type: object properties: enabled: type: boolean description: Adaptive MFA settings. singleSignOnEnabled: type: boolean supportEmail: type: string nullable: true description: The support email address to display on the error pages. supportWebsiteUrl: type: string nullable: true description: The support website URL to display on the error pages. unknownSessionRedirectUrl: type: string nullable: true description: The fallback URL to redirect users when the sign-in session does not exist or unknown. Client should initiates a new authentication flow after the redirection. captchaPolicy: type: object properties: enabled: type: boolean sentinelPolicy: type: object properties: maxAttempts: type: number lockoutDuration: type: number description: Custom sentinel policy settings. Use this field to customize the user lockout policy. The default value is 100 failed attempts within one hour. The user will be locked out for 60 minutes after exceeding the limit. emailBlocklistPolicy: type: object properties: blockDisposableAddresses: type: boolean blockSubaddressing: type: boolean description: Whether to block sub-addresses. (E.g., example+shopping@test.com) customBlocklist: type: array items: type: string description: Custom blocklist of email addresses or domains. blockDisposableAddress: description: Cloud only. Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked. description: Define email restriction policies. Users will be prohibited from registering or linking any email addresses that are included in the blocklist. forgotPasswordMethods: type: array items: type: string enum: - EmailVerificationCode - PhoneVerificationCode nullable: true passkeySignIn: type: object properties: enabled: type: boolean showPasskeyButton: type: boolean allowAutofill: type: boolean signUpProfileFields: type: array items: type: object required: - name properties: name: type: string nullable: true '401': description: Unauthorized '403': description: Forbidden '404': description: Default sign-in experience settings not found. summary: Get default sign-in experience settings description: Get the default sign-in experience settings. patch: operationId: UpdateSignInExp tags: - Sign-in experience parameters: - name: removeUnusedDemoSocialConnector in: query required: false schema: type: string description: Whether to remove unused demo social connectors. (These demo social connectors are only used during cloud user onboarding) requestBody: required: true content: application/json: schema: type: object properties: tenantId: type: string maxLength: 21 color: type: object required: - primaryColor - isDarkModeEnabled - darkPrimaryColor properties: primaryColor: type: string format: regex pattern: /^#[\da-f]{3}([\da-f]{3})?$/i isDarkModeEnabled: type: boolean darkPrimaryColor: type: string format: regex pattern: /^#[\da-f]{3}([\da-f]{3})?$/i description: Specify the primary branding color for the sign-in page (both light/dark mode). branding: type: object properties: logoUrl: type: string format: url darkLogoUrl: type: string format: url favicon: type: string format: url darkFavicon: type: string format: url hideLogtoBranding: type: boolean description: Cloud only. Whether to hide the Logto branding on hosted sign-in pages. languageInfo: type: object required: - autoDetect - fallbackLanguage properties: autoDetect: type: boolean fallbackLanguage: type: string enum: - af-ZA - am-ET - ar - ar-AR - as-IN - az-AZ - be-BY - bg-BG - bn-IN - br-FR - bs-BA - ca-ES - cb-IQ - co-FR - cs - cs-CZ - cx-PH - cy-GB - da-DK - de - de-DE - el-GR - en - en-GB - en-US - eo-EO - es - es-ES - es-419 - et-EE - eu-ES - fa-IR - ff-NG - fi - fi-FI - fo-FO - fr - fr-CA - fr-FR - fy-NL - ga-IE - gl-ES - gn-PY - gu-IN - ha-NG - he-IL - hi-IN - hr-HR - ht-HT - hu-HU - hy-AM - id-ID - ik-US - is-IS - it - it-IT - iu-CA - ja - ja-JP - ja-KS - jv-ID - ka-GE - kk-KZ - km-KH - kn-IN - ko - ko-KR - ku-TR - ky-KG - lo-LA - lt-LT - lv-LV - mg-MG - mk-MK - ml-IN - mn-MN - mr-IN - ms-MY - mt-MT - my-MM - nb-NO - ne-NP - nl - nl-BE - nl-NL - nn-NO - or-IN - pa-IN - pl-PL - ps-AF - pt - pt-BR - pt-PT - ro-RO - ru - ru-RU - rw-RW - sc-IT - si-LK - sk-SK - sl-SI - sn-ZW - sq-AL - sr-RS - sv - sv-SE - sw-KE - sy-SY - sz-PL - ta-IN - te-IN - tg-TJ - th - th-TH - tl-PH - tr - tr-TR - tt-RU - tz-MA - uk-UA - ur-PK - uz-UZ - vi-VN - zh - zh-CN - zh-HK - zh-MO - zh-TW - zz-TR description: Control the language detection policy for the sign-in page. agreeToTermsPolicy: type: string enum: - Automatic - ManualRegistrationOnly - Manual signIn: type: object required: - methods properties: methods: type: array items: type: object required: - identifier - password - verificationCode - isPasswordPrimary properties: identifier: type: string enum: - username - email - phone password: type: boolean verificationCode: type: boolean isPasswordPrimary: type: boolean description: Sign-in method settings signUp: type: object required: - identifiers - password - verify properties: identifiers: type: array items: type: string enum: - username - email - phone description: Specify allowed identifiers when signing-up. password: type: boolean description: Whether the user is required to set a password when signing-up. verify: type: boolean description: Whether the user is required to verify their email/phone when signing-up. secondaryIdentifiers: type: array items: type: object required: - identifier properties: identifier: oneOf: - type: string enum: - username - email - phone - type: string enum: - emailOrPhone verify: type: boolean description: Sign-up method settings socialSignIn: type: object properties: automaticAccountLinking: type: boolean skipRequiredIdentifiers: type: boolean socialSignInConnectorTargets: type: array items: type: string description: Specify the social sign-in connectors to display on the sign-in page. signInMode: type: string enum: - SignIn - Register - SignInAndRegister customCss: type: string nullable: true customContent: type: object additionalProperties: type: string description: Custom content to display on experience flow pages. the page pathname will be the config key, the content will be the config value. customUiAssets: type: object required: - id - createdAt properties: id: type: string createdAt: type: number nullable: true passwordPolicy: type: object properties: length: default: {} type: object required: - min - max properties: min: default: 8 type: number max: default: 256 type: number characterTypes: default: {} type: object required: - min properties: min: default: 1 type: number rejects: default: {} type: object required: - pwned - repetitionAndSequence - userInfo - words properties: pwned: default: true type: boolean repetitionAndSequence: default: true type: boolean userInfo: default: true type: boolean words: default: [] type: array items: type: string description: Password policies to adjust the password strength requirements. mfa: type: object required: - factors - policy properties: factors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode policy: type: string enum: - UserControlled - Mandatory - PromptOnlyAtSignIn - PromptAtSignInAndSignUp - NoPrompt - PromptAtSignInAndSignUpMandatory - PromptOnlyAtSignInMandatory organizationRequiredMfaPolicy: type: string enum: - NoPrompt - Mandatory description: MFA settings adaptiveMfa: type: object properties: enabled: type: boolean description: Adaptive MFA settings. Only effective when developer features are enabled. singleSignOnEnabled: type: boolean captchaPolicy: type: object properties: enabled: type: boolean sentinelPolicy: type: object properties: maxAttempts: type: number lockoutDuration: type: number description: Custom sentinel policy settings. Use this field to customize the user lockout policy. The default value is 100 failed attempts within one hour. The user will be locked out for 60 minutes after exceeding the limit. emailBlocklistPolicy: type: object properties: blockDisposableAddresses: type: boolean blockSubaddressing: type: boolean description: Whether to block sub-addresses. (E.g., example+shopping@test.com) customBlocklist: type: array items: type: string description: Custom blocklist of email addresses or domains. blockDisposableAddress: description: Cloud only. Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked. description: Define email restriction policies. Users will be prohibited from registering or linking any email addresses that are included in the blocklist. forgotPasswordMethods: type: array items: type: string enum: - EmailVerificationCode - PhoneVerificationCode nullable: true passkeySignIn: type: object properties: enabled: type: boolean showPasskeyButton: type: boolean allowAutofill: type: boolean signUpProfileFields: type: array items: type: object required: - name properties: name: type: string nullable: true termsOfUseUrl: oneOf: - type: string format: url nullable: true - type: string format: empty privacyPolicyUrl: oneOf: - type: string format: url nullable: true - type: string format: empty supportEmail: oneOf: - type: string format: email nullable: true - type: string format: empty description: The support email address to display on the error pages. supportWebsiteUrl: oneOf: - type: string format: url nullable: true - type: string format: empty description: The support website URL to display on the error pages. unknownSessionRedirectUrl: oneOf: - type: string format: url nullable: true - type: string format: empty description: The fallback URL to redirect users when the sign-in session does not exist or unknown. Client should initiate a new authentication flow after the redirection. responses: '200': description: Updated default sign-in experience settings. content: application/json: schema: type: object required: - tenantId - id - color - branding - hideLogtoBranding - languageInfo - termsOfUseUrl - privacyPolicyUrl - agreeToTermsPolicy - signIn - signUp - socialSignIn - socialSignInConnectorTargets - signInMode - customCss - customContent - customUiAssets - passwordPolicy - mfa - adaptiveMfa - singleSignOnEnabled - supportEmail - supportWebsiteUrl - unknownSessionRedirectUrl - captchaPolicy - sentinelPolicy - emailBlocklistPolicy - forgotPasswordMethods - passkeySignIn - signUpProfileFields properties: tenantId: type: string maxLength: 21 id: type: string minLength: 1 maxLength: 21 color: type: object required: - primaryColor - isDarkModeEnabled - darkPrimaryColor properties: primaryColor: type: string format: regex pattern: /^#[\da-f]{3}([\da-f]{3})?$/i isDarkModeEnabled: type: boolean darkPrimaryColor: type: string format: regex pattern: /^#[\da-f]{3}([\da-f]{3})?$/i branding: type: object properties: logoUrl: type: string format: url darkLogoUrl: type: string format: url favicon: type: string format: url darkFavicon: type: string format: url hideLogtoBranding: type: boolean languageInfo: type: object required: - autoDetect - fallbackLanguage properties: autoDetect: type: boolean fallbackLanguage: type: string enum: - af-ZA - am-ET - ar - ar-AR - as-IN - az-AZ - be-BY - bg-BG - bn-IN - br-FR - bs-BA - ca-ES - cb-IQ - co-FR - cs - cs-CZ - cx-PH - cy-GB - da-DK - de - de-DE - el-GR - en - en-GB - en-US - eo-EO - es - es-ES - es-419 - et-EE - eu-ES - fa-IR - ff-NG - fi - fi-FI - fo-FO - fr - fr-CA - fr-FR - fy-NL - ga-IE - gl-ES - gn-PY - gu-IN - ha-NG - he-IL - hi-IN - hr-HR - ht-HT - hu-HU - hy-AM - id-ID - ik-US - is-IS - it - it-IT - iu-CA - ja - ja-JP - ja-KS - jv-ID - ka-GE - kk-KZ - km-KH - kn-IN - ko - ko-KR - ku-TR - ky-KG - lo-LA - lt-LT - lv-LV - mg-MG - mk-MK - ml-IN - mn-MN - mr-IN - ms-MY - mt-MT - my-MM - nb-NO - ne-NP - nl - nl-BE - nl-NL - nn-NO - or-IN - pa-IN - pl-PL - ps-AF - pt - pt-BR - pt-PT - ro-RO - ru - ru-RU - rw-RW - sc-IT - si-LK - sk-SK - sl-SI - sn-ZW - sq-AL - sr-RS - sv - sv-SE - sw-KE - sy-SY - sz-PL - ta-IN - te-IN - tg-TJ - th - th-TH - tl-PH - tr - tr-TR - tt-RU - tz-MA - uk-UA - ur-PK - uz-UZ - vi-VN - zh - zh-CN - zh-HK - zh-MO - zh-TW - zz-TR termsOfUseUrl: type: string maxLength: 2048 nullable: true privacyPolicyUrl: type: string maxLength: 2048 nullable: true agreeToTermsPolicy: type: string enum: - Automatic - ManualRegistrationOnly - Manual signIn: type: object required: - methods properties: methods: type: array items: type: object required: - identifier - password - verificationCode - isPasswordPrimary properties: identifier: type: string enum: - username - email - phone password: type: boolean verificationCode: type: boolean isPasswordPrimary: type: boolean signUp: type: object required: - identifiers - password - verify properties: identifiers: type: array items: type: string enum: - username - email - phone password: type: boolean verify: type: boolean secondaryIdentifiers: type: array items: type: object required: - identifier properties: identifier: oneOf: - type: string enum: - username - email - phone - type: string enum: - emailOrPhone verify: type: boolean socialSignIn: type: object properties: automaticAccountLinking: type: boolean skipRequiredIdentifiers: type: boolean socialSignInConnectorTargets: type: array items: type: string signInMode: type: string enum: - SignIn - Register - SignInAndRegister customCss: type: string nullable: true customContent: type: object additionalProperties: type: string customUiAssets: type: object required: - id - createdAt properties: id: type: string createdAt: type: number nullable: true passwordPolicy: type: object properties: length: default: {} type: object required: - min - max properties: min: default: 8 type: number max: default: 256 type: number characterTypes: default: {} type: object required: - min properties: min: default: 1 type: number rejects: default: {} type: object required: - pwned - repetitionAndSequence - userInfo - words properties: pwned: default: true type: boolean repetitionAndSequence: default: true type: boolean userInfo: default: true type: boolean words: default: [] type: array items: type: string mfa: type: object required: - factors - policy properties: factors: type: array items: type: string enum: - Totp - WebAuthn - BackupCode - EmailVerificationCode - PhoneVerificationCode policy: type: string enum: - UserControlled - Mandatory - PromptOnlyAtSignIn - PromptAtSignInAndSignUp - NoPrompt - PromptAtSignInAndSignUpMandatory - PromptOnlyAtSignInMandatory organizationRequiredMfaPolicy: type: string enum: - NoPrompt - Mandatory adaptiveMfa: type: object properties: enabled: type: boolean singleSignOnEnabled: type: boolean supportEmail: type: string nullable: true supportWebsiteUrl: type: string nullable: true unknownSessionRedirectUrl: type: string nullable: true captchaPolicy: type: object properties: enabled: type: boolean sentinelPolicy: type: object properties: maxAttempts: type: number lockoutDuration: type: number emailBlocklistPolicy: type: object properties: blockDisposableAddresses: type: boolean blockSubaddressing: type: boolean customBlocklist: type: array items: type: string forgotPasswordMethods: type: array items: type: string enum: - EmailVerificationCode - PhoneVerificationCode nullable: true passkeySignIn: type: object properties: enabled: type: boolean showPasskeyButton: type: boolean allowAutofill: type: boolean signUpProfileFields: type: array items: type: object required: - name properties: name: type: string nullable: true '400': description: Bad request. Invalid data provided. '401': description: Unauthorized '403': description: Forbidden '404': description: Default sign-in experience settings not found. '422': description: Unprocessable Entity. Invalid data provided. summary: Update default sign-in experience settings description: Update the default sign-in experience settings with the provided data. /api/sign-in-exp/default/check-password: post: operationId: CheckPasswordWithDefaultSignInExperience tags: - Sign-in experience parameters: [] requestBody: required: true content: application/json: schema: type: object required: - password properties: password: type: string description: The password to check. userId: type: string description: The user ID to check the password for. It is required if rejects user info is enabled in the password policy. responses: '200': description: The password meets the password policy. content: application/json: schema: oneOf: - type: object required: - result properties: result: type: boolean format: 'true' - type: object required: - result - issues properties: result: type: boolean format: 'false' issues: type: array items: type: object required: - code properties: code: type: string interpolation: type: object additionalProperties: example: {} '400': description: The password does not meet the password policy or no user ID provided. '401': description: Unauthorized '403': description: Forbidden summary: Check if a password meets the password policy description: Check if a password meets the password policy in the sign-in experience settings. /api/sign-in-exp/default/custom-ui-assets: post: operationId: UploadCustomUiAssets tags: - Sign-in experience parameters: [] requestBody: content: multipart/form-data: schema: properties: file: description: The zip file containing custom web assets such as HTML, CSS, and JavaScript files. responses: '200': description: An JSON object containing the custom UI assets ID. content: application/json: schema: type: object required: - customUiAssetId properties: customUiAssetId: type: string '400': description: Bad request. The request body is invalid. '401': description: Unauthorized '403': description: Forbidden '500': description: Failed to unzip or upload the custom UI assets to storage provider. summary: Upload custom UI assets description: Upload a zip file containing custom web assets such as HTML, CSS, and JavaScript files, then replace the default sign-in experience with the custom UI assets. components: securitySchemes: OAuth2: type: oauth2 description: "Logto Management API is a comprehensive set of REST APIs that gives you the full control over Logto to suit your product needs and tech stack. To see the full guide on Management API interactions, visit [Interact with Management API](https://docs.logto.io/docs/recipes/interact-with-management-api/).\n\n### Get started\n\nThe API follows the same authentication principles as other API resources in Logto, with some slight differences. To use Logto Management API:\n\n1. A machine-to-machine (M2M) application needs to be created.\n2. A machine-to-machine (M2M) role with Management API permission `all` needs to be assigned to the application.\n\nOnce you have them set up, you can use the `client_credentials` grant type to fetch an access token and use it to authenticate your requests to the Logto Management API.\n\n### Fetch an access token\n\nTo fetch an access token, you need to make a `POST` request to the `/oidc/token` endpoint of your Logto tenant.\n\nFor Logto Cloud users, the base URL is your Logto endpoint, i.e. `https://[tenant-id].logto.app`. The tenant ID can be found in the following places:\n\n- The first path segment of the URL when you are signed in to Logto Cloud. For example, if the URL is `https://cloud.logto.io/foo/get-started`, the tenant ID is `foo`.\n- In the \"Settings\" tab of Logto Cloud.\n\nThe request should follow the OAuth 2.0 [client credentials](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4) grant type. Here is a non-normative example of how to fetch an access token:\n\n```bash\ncurl --location \\\n --request POST 'https://[tenant-id].logto.app/oidc/token' \\\n --header 'Content-Type: application/x-www-form-urlencoded' \\\n --data-urlencode 'grant_type=client_credentials' \\\n --data-urlencode 'client_id=[app-id]' \\\n --data-urlencode 'client_secret=[app-secret]' \\\n --data-urlencode 'resource=https://[tenant-id].logto.app/api' \\\n --data-urlencode 'scope=all'\n```\n\nReplace `[tenant-id]`, `[app-id]`, and `[app-secret]` with your Logto tenant ID, application ID, and application secret, respectively.\n\nThe response will be like:\n\n```json\n{\n \"access_token\": \"eyJhbG...2g\", // Use this value for accessing the Logto Management API\n \"expires_in\": 3600, // Token expiration in seconds\n \"token_type\": \"Bearer\", // Token type for your request when using the access token\n \"scope\": \"all\" // Scope `all` for Logto Management API\n}\n```\n\n### Use the access token\n\nOnce you have the access token, you can use it to authenticate your requests to the Logto Management API. The access token should be included in the `Authorization` header of your requests with the `Bearer` authentication scheme.\n\nHere is an example of how to list the first page of users in your Logto tenant:\n\n```bash\ncurl --location \\\n --request GET 'https://[tenant-id].logto.app/api/users' \\\n --header 'Authorization: Bearer eyJhbG...2g'\n```\n\nReplace `[tenant-id]` with your Logto tenant ID and `eyJhbG...2g` with the access token you fetched earlier." flows: clientCredentials: tokenUrl: /oidc/token scopes: all: All scopes