> ## Documentation Index
> Fetch the complete documentation index at: https://developers.bm.cards/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> OAuth2 client_credentials for the Brand API

All Brand API requests require a **Bearer access token**. Use the same flow for every endpoint in the **API Reference** playground: obtain a token first, then call Brand API paths with `Authorization: Bearer YOUR_ACCESS_TOKEN`.

## OAuth2 client credentials

Request a token with `POST` and `Content-Type: application/x-www-form-urlencoded`:

```bash theme={null}
curl -X POST "https://api-auth.bambumeta.software/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=https://admin.bambumeta.software/ui"
```

For sandbox, use `https://api-auth-sandbox.bambumeta.software/oauth2/token`.

### Response

```json theme={null}
{
  "access_token": "eyJ...",
  "expires_in": 3600,
  "token_type": "Bearer"
}
```

## Calling the Brand API

Include the token on every request:

```bash theme={null}
curl "https://api.bambumeta.software/brands/YOUR_BRAND_ID/programs/YOUR_PROGRAM_ID/wallets?unique_id=1001" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

## Token lifetime

Tokens expire. When you receive `401 Unauthorized`, request a new token. Do not embed long-lived tokens in client-side code.

## Security

* Store `client_secret` only on your server.
* Never commit secrets to source control or share them in support channels.
* Rotate credentials if a secret is exposed.

## API Reference playground

In the **API Reference** tab, each endpoint uses this OAuth scheme (`cognito-authorizer`). Mintlify does not call the token URL for you. Paste a token from the curl example above into the playground **Authorization** field, or configure your client to refresh tokens before they expire.