> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manus.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# oauth.token

> Exchanges a `client_id` + `client_secret` for a short-lived OAuth 2.0 access token. The token is required for every `/api/user/manage/v1/users*` request. **Token lifetime is 1 hour (3600 seconds)** — cache and reuse until expiry.

<sup>Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).</sup>

<Tip>
  **Auth:** None — credentials live in the form body, not a header.

  **Token lifetime:** 1 hour (3600 seconds). Cache and reuse — re-minting on every request will hit rate limits.

  **Content-Type:** `application/x-www-form-urlencoded` (not JSON).

  **Scope:** The returned access token only authorises `/api/user/manage/v1/users*` calls. It does **not** authorise the credential management RPCs (`/team.v1.TeamManagementService/*`) — those use a session token.

  **Errors:**

  * `400 INVALID_GRANT_TYPE` — `grant_type` must be exactly `client_credentials`.
  * `400 INVALID_REQUEST` — `client_id` or `client_secret` is missing.
  * `401 INVALID_CLIENT` — credentials are unknown or have been deleted.

  **SailPoint settings:** Token URL is `/api/user/manage/v1/oauth/token`, grant type `client_credentials`. See the SailPoint integration notes in the [overview](/enterprise/v1/user-management-overview).
</Tip>


## OpenAPI

````yaml POST /api/user/manage/v1/oauth/token
openapi: 3.1.0
info:
  title: Manus Team User Management OpenAPI v1
  description: >-
    API for enterprise tenant administrators to manage team members
    programmatically (SailPoint, Okta, custom IDP integrations). Two surfaces:
    (1) credential management RPCs at `/team.v1.TeamManagementService/*` use a
    session token; (2) REST endpoints under `/api/user/manage/v1/*` use an OAuth
    2.0 Client Credentials access token issued by the credentials. v2 of this
    API ([User Management v2](/enterprise/v2/user-management-overview))
    consolidates everything behind `X-API-Key` — prefer it for new integrations.
  version: 1.0.0
servers:
  - url: https://api.manus.im
security: []
paths:
  /api/user/manage/v1/oauth/token:
    post:
      summary: Obtain Access Token
      description: >-
        Exchanges a `client_id` + `client_secret` for a short-lived OAuth 2.0
        access token. The token is required for every
        `/api/user/manage/v1/users*` request. **Token lifetime is 1 hour (3600
        seconds)** — cache and reuse until expiry.
      operationId: team.v1.OAuthToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
                - grant_type
                - client_id
                - client_secret
              properties:
                grant_type:
                  type: string
                  enum:
                    - client_credentials
                  description: Must be `client_credentials`.
                  example: client_credentials
                client_id:
                  type: string
                  description: >-
                    Client identifier issued by
                    [team.v1.TeamManagementService/CreateApiCredential](/enterprise/v1/team.credential.create).
                  example: tm_RRa7dgjD_AFhru6AnZJ8W
                client_secret:
                  type: string
                  description: >-
                    Client secret issued by
                    [team.v1.TeamManagementService/CreateApiCredential](/enterprise/v1/team.credential.create).
                  example: >-
                    a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456
      responses:
        '200':
          description: Token issued successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    description: >-
                      OAuth 2.0 Bearer access token. Pass as `Authorization:
                      Bearer <token>` on every users endpoint.
                    example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
                  token_type:
                    type: string
                    enum:
                      - Bearer
                  expires_in:
                    type: integer
                    format: int32
                    description: Token lifetime in seconds.
                    example: 3600
        '400':
          description: >-
            `INVALID_GRANT_TYPE` if `grant_type` is not `client_credentials`;
            `INVALID_REQUEST` if `client_id`/`client_secret` is missing.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: '`INVALID_CLIENT` — the credentials are unknown or have been deleted.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security: []
components:
  schemas:
    ErrorResponse:
      type: object
      description: Standard REST error format.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: >-
                Machine-readable error code: `INVALID_REQUEST`,
                `INVALID_GRANT_TYPE`, `UNAUTHORIZED`, `INVALID_CLIENT`,
                `USER_NOT_FOUND`, `USER_ALREADY_EXISTS`, or `INTERNAL_ERROR`.
            message:
              type: string

````