## OAuth clients

URL: https://docs.atlan.com/get-started/references/api-access/oauth-clients

> Use OAuth 2.0 Client Credentials flow for short-lived access tokens in machine-to-machine integrations

OAuth clients provide secure, programmatic authentication to Atlan using the OAuth 2.0 **Client Credentials** flow. Instead of issuing a long-lived token, an OAuth client (identified by a client ID and client secret) obtains **short-lived access tokens** on demand and presents them to Atlan APIs using the standard `Authorization: Bearer` header. 

## Prerequisites

- **Admin access** to create and manage OAuth clients.
- A defined **scope** for the client:
 - **Role/subrole** to control which administrative and governance APIs it may call.
 - **Personas** to grant access to the required connections and assets (least-privilege).
- Your tenant base URL (for example, `https://<your-tenant>.atlan.com`) to construct API requests.

## Create OAuth client

Create a client that can obtain short-lived access tokens for programmatic authentication.

1. Open your tenant and click **Admin** from the left menu.

2. Click **API access**, then open the **OAuth** tab.

3. In the upper-right, click **Generate new** and select **Generate OAuth Client**.

4. In **Name**, enter an identifier for the integration. For example:

 ```
 dbt-cloud-sync
 ```

5. In **Description**, add concise context for future administrators. 

 ```
 Service account for dbt Cloud → Atlan sync
 ```

6. In **Role**, choose the base role, it controls which administrative/governance APIs the client can call. 

7. In **Personas**, select personas that grant access to the required connections and assets. 

8. Click **Save** to create the client.

9. **Copy the Client ID and Client Secret** and store them securely (secret manager or vault).

:::warning One-time visibility
The client secret is displayed only once after creation. If it's lost, delete the client and create a new one.
:::

## Use OAuth client

To use an OAuth client, obtain a short-lived access token with the client credentials and present that token as a bearer credential in each request.

1. Request a short-lived access token from your tenant’s token endpoint.

 **Endpoint** 

 ```
 POST https://<your-instance-name>.atlan.com/api/service/oauth-clients/token
 ```

 **Request (HTTP)**

 ```http
 Content-Type: application/json

 {
 "clientId": "<client-id>",
 "clientSecret": "<client-secret>"
 }
 ```

2. Read `access_token` and `expires_in` from the response, then attach the token to each API request.

 ```
 Authorization: Bearer <access_token>
 ```

3. Call the desired API endpoint under your tenant base URL using the bearer token. For example, to list available type definitions:

 ```http
 GET https://<your-tenant>.atlan.com/api/meta/types 
 ```

 **Headers**:

 ```
 Authorization: Bearer <access_token>
 Content-Type: application/json
 ```

4. Refresh the token before the `expires_in` period ends or immediately after a `401 Unauthorized`. 

## See also

* [API token](https://docs.atlan.com/llms/platform/get-started/api-access/llms.txt)
* [Getting started with the APIs](https://docs.atlan.com/llms/platform/get-started/getting-started-with-the-apis/llms.txt)
* [Atlan's Open API](https://docs.atlan.com/llms/platform/get-started/atlan-s-open-api/llms.txt)

---