Skip to content
Linra Omni Developer Docs

Exchange a client ID and secret for an access token

POST
/api/v1/auth/token
curl --request POST \
  --url https://api-omni.linra.net/api/v1/auth/token \
  --header 'Content-Type: application/json' \
  --data '{ "clientId": "live_9f8c2a1b4e6d4a7c9b0e3f2d1c8a5b6e", "clientSecret": "••••••••••••••••••••••••••••••••••••••••••••••" }'

The credential-exchange door. Anonymous — no bearer token is required (you don’t have one yet). Rate-limited independently of every other route (see the Rate limits guide). Returns a JWT (audience partner-api) valid for 5 minutes; see the Authentication guide for the recommended caching pattern.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
clientId
required
string
clientSecret
required
string format: password
onBehalfOf

Optional — delegate the issued token’s identity to a descendant partner (materialized-path-checked). Rare; most integrations omit this.

string format: uuid
nullable
Example
{
  "clientId": "live_9f8c2a1b4e6d4a7c9b0e3f2d1c8a5b6e",
  "clientSecret": "••••••••••••••••••••••••••••••••••••••••••••••"
}

Responses

Section titled “Responses”

200

Section titled “200”

A new access token.

Media typeapplication/json
object
state
required
string
payload
required
details
object
payload
required
object
accessToken
string
tokenType
string
expiresIn

Seconds until expiry — always 300 (5 minutes) today.

integer
Example
{
  "state": "SUCCESS",
  "payload": {
    "tokenType": "Bearer",
    "expiresIn": 300
  }
}

401

Section titled “401”

Invalid client ID/secret, or an inactive partner.

Media typeapplication/json

The envelope every /api/v1 ERROR response uses. state carries the machine-readable error code (see the Errors guide).

object
state
required
string
payload
required

Always null on an error response.

object
details
object
Examples
{
  "state": "UNAUTHORIZED_INVALID_CREDENTIALS",
  "payload": null,
  "details": {}
}

403

Section titled “403”

Delegation (onBehalfOf) target is invalid or not a descendant of the caller.

Media typeapplication/json

The envelope every /api/v1 ERROR response uses. state carries the machine-readable error code (see the Errors guide).

object
state
required
string
payload
required

Always null on an error response.

object
details
object
Examples
{
  "state": "FORBIDDEN_NOT_YOUR_DESCENDANT",
  "payload": null,
  "details": {}
}

429

Section titled “429”

Too many requests — see the Rate limits guide. Retry after the Retry-After header (seconds).

Media typeapplication/json

The envelope every /api/v1 ERROR response uses. state carries the machine-readable error code (see the Errors guide).

object
state
required
string
payload
required

Always null on an error response.

object
details
object
Example
{
  "state": "NOT_FOUND_ORDER",
  "payload": null
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before retrying.