# Hyperproof TPRM Core API — Oauth

Obtain OAuth 2.1 access tokens (client_credentials).

Version: 1.0

## Servers

Production
```
https://api.expent.ai
```

Demo
```
https://demoapi.expent.ai
```

Development
```
https://devapi.expent.ai
```

## Security

### OAuth2ClientCredentials

OAuth 2.1 client_credentials — exchange client_id/client_secret for a 10-minute Bearer token.

Type: oauth2

### OrgUserJWT

Org login token (`Authorization: JWT <token>`) — the /manage surface is for your org's logged-in users via the Hyperproof UI, not for API credentials.

Type: apiKey
In: header
Name: Authorization

## Download OpenAPI description

[Hyperproof TPRM Core API — Oauth](https://developer.hyperproof.app/_bundle/hyperproof-tprm/yaml/oauth.openapi.yaml)

## Other

### Issue Token

 - [POST /tprm-api/oauth/token](https://developer.hyperproof.app/hyperproof-tprm/yaml/oauth.openapi/other/issue_token_tprm_api_oauth_token_post.md): Exchange your client_id / client_secret for a 10-minute access token
(client_credentials grant). See the Authentication guide for the full
flow, scopes, and optional DPoP. Returns
{access_token, token_type, expires_in, scope}.