> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aspect.systems/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Aspect Systems API

The Aspect Systems API uses OAuth 2.0 with the Client Credentials grant type for authentication. This page explains how to obtain and use access tokens to authenticate your API requests.

## OAuth 2.0 Client Credentials

To access the API, you'll need to:

<Steps>
  <Step title="Obtain client credentials (client ID and client secret) from Aspect Systems" />

  <Step title="Exchange these credentials for an access token" />

  <Step title="Include the access token in the Authorization header of your API requests" />
</Steps>

## Obtaining Client Credentials

Contact Aspect Systems support to obtain your client ID and client secret. These credentials are unique to your application and should be kept secure.

<Card title="Request Credentials" icon="envelope" href="mailto:support@aspect.systems">
  Email our support team to request API credentials.
</Card>

## Obtaining an Access Token

Make a request to the token endpoint to obtain an access token.

<Card title="Obtain Access Token" icon="code" href="/api/authentication/obtain-access-token">
  Learn more about the token endpoint.
</Card>

## Using the Access Token

Include the access token in the Authorization header of all API requests:

```
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...
```

## Token Expiration

Access tokens are valid for 30 days (2,592,000 seconds). After a token expires, you'll need to request a new one using the same process.

<Note>We suggest you generate a new token before it's expiration (i.e. after 15 days).</Note>

## Security Best Practices

* Keep your client credentials secure and never expose them in client-side code
* Store access tokens securely
* Implement token refresh logic to handle token expiration
* Use HTTPS for all API requests
* Validate JWT tokens on your server before trusting the contained information