---
updatedAt: 2026-09-16T20:41:12.000Z
agentTools:
  projectIndex: https://cabify-api.readme.io/llms.txt
---

# 3. Get your Access Token

All requests to Cabify API have to be authorized. This means that with the **OAuth UUID** and **Secret** of the integration you created in the previous step, you will have to generate an access token. All subsequent requests that you make to the API have to have a valid access token to authorize the request.

To get your **Access Token** token make the following POST request using your favorite HTTP client (curl example using sandbox environment):

```curl
curl -X POST -d "grant_type=client_credentials&client_id=OAUTH_UUID&client_secret=SECRET" https://cabify-sandbox.com/auth/api/authorization
```

The success response should be like this:

```json
{
  "token_type": "Bearer",
  "expires_in": 2591999,
  "access_token":"1Lex4yzYz0M1NoMa-kfE1Uj3BdDd18"
}
```

**IMPORTANT:** The value of the key itself will only be shown once at the time of creation, so be sure to save it somewhere securely immediately.

> 📘 Why the parameter is called `client_id`
>
> You send your integration's **OAuth UUID** in a parameter named `client_id` because that is the parameter name defined by the OAuth2 standard for a client credentials request.
>
> This is **not** the same thing as your Cabify account's `client_id`, the value we send in the `X-CABIFY-CLIENT-ID` header and in `data.client_id` of every webhook. They are two different identifiers: the OAuth UUID identifies your integration and is a shared secret, while the account `client_id` identifies your Cabify account and is public. See [Webhook Headers](https://cabify-api.readme.io/docs/webhook-headers).

All requests (sandbox and production environments) should include an access token in an Authorization header

> 📘 Expiration time
>
> Please note that access token expires for security reasons. You will have to renew it before it expires (see below).
> `expires_in` field is in seconds, which is approximately 30 days.

### Token Refresh

To refresh an access token you need to create a new token when the current one is about to expire, using the "expires\_in" field obtained previously. All this logic should be **implemented on the client's side**.

### Token Revocation

The Token Revocation extension defines a mechanism for clients to indicate to the authorization server that an access token is no longer needed. This is used to enable a "log out" feature in clients, allowing the authorization server to clean up any security credentials associated with the authorization.

To revoke an access token make a **DELETE** request such as this one:

```curl
curl -v -X DELETE
    --url 'https://cabify-sandbox.com/auth/api/authorization'
    --header 'authorization: Bearer THwi13of2EHnPsSdfYmrB7Q17P6soi'
```

You will get an `HTTP 204 Code` response if the operation is successful.