Get an Access Token

Exchanges your integrator client credentials for a bearer token. Send the token as Authorization: Bearer <access_token> on every other v2 request.

Endpoint

POST /v2/oauth/token

Request Body

Parameter	Type	Required	Description
grant_type	string	Yes	Must be client_credentials.
client_id	string	Yes	Your integrator client id.
client_secret	string	Yes	Your integrator client secret.
scope	string	No	Granted scopes.

Request

curl --location '{base_url}/v2/oauth/token' \
  --header 'Authorization: Bearer JWT_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "grant_type": "client_credentials",
  "client_id": "spry-client-4f8c21a9",
  "client_secret": "YOUR_CLIENT_SECRET",
  "scope": "read write"
}'

Response

Success Response

Code: 200 OK

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read write"
}

Response Fields

Field	Type	Description
access_token	string	The bearer token to send as Authorization: Bearer <token>.
token_type	string
expires_in	integer	Token lifetime in seconds.
scope	string	Granted scopes.

Error Response

Code: 400 Bad Request

{
  "code": "bad_request",
  "message": "Validation failed",
  "errors": [
    {
      "field": "patient_id",
      "message": "must be a string"
    }
  ]
}

Every error has the same shape — a machine-readable code, a message, and an errors[] array that's empty when there's nothing field-specific to report. The HTTP status is authoritative.

Status	code	Meaning
400 Bad Request	bad_request	The request body or parameters failed validation. errors[] names the offending fields.
401 Unauthorized	unauthorized	The access token is missing, malformed or expired.
429 Too Many Requests	rate_limited	Rate limit exceeded. Back off and retry.
502 Bad Gateway	upstream_error	Upstream service failed or timed out.

Notes

• This is the only v2 endpoint that doesn't itself require a bearer token.
• Contact Spry to be issued a client_id and client_secret.