---
title: Authentication - APIs
description: Authenticate to the Responses API with OAuth 2.0 client credentials and a bearer token.
source_url:
  html: https://docs.contentsquare.com/fr/api/responses/authentication/
  md: https://docs.contentsquare.com/fr/api/responses/authentication/index.md
---

> ## Documentation index
> Fetch the complete documentation index at: https://docs.contentsquare.com/llms.txt
> Use this file to discover all available pages before exploring further.

> **Note**
>
> Cette page est affichée en anglais car elle n'est pas disponible dans votre langue.

Contentsquare APIs authenticate via server-to-server OAuth 2.0 credentials generated from the Contentsquare console.

The flow consists of calling an authentication endpoint with a `client_id` / `client_secret` pair to retrieve an access token that remains valid for 1 hour. Use this JWT token as a Bearer token in the headers of your HTTPS requests, in the form `Authorization: Bearer YOUR_ACCESS_TOKEN`.

You can generate a `client_id` / `client_secret` pair from the Contentsquare [console ↗](https://console.contentsquare.com), as a Contentsquare administrator. See [How to create API credentials ↗](https://support.contentsquare.com/hc/en-us/articles/37271728104593-How-to-create-API-credentials).

Create OAuth credentials at the **project level**, to access resources of a specific project only.

> **Attention**
>
> Your OAuth credentials carry many privileges, so keep them secure. Don't share them in publicly accessible areas such as GitHub, or in client-side code.

## Authentication endpoint

POST [https://api.contentsquare.com/v1/oauth/token ↗](https://api.contentsquare.com/v1/oauth/token)

### Request parameters

* `client_id`  *string*  **Required**

  The OAuth `client_id` generated from the Contentsquare console.

* `client_secret`  *string*  **Required**

  The OAuth `client_secret` generated from the Contentsquare console.

* `grant_type`  *string*  **Required**

  Always set it to `"client_credentials"`, as required by the OAuth 2.0 standard.

* `scope`  *string*  **Required**

  Use `"surveys"`.

* `project_id`  *integer*  

  Specify which project of the account you want to target.

### Request example

```shell
curl --location 'https://api.contentsquare.com/v1/oauth/token' \
--header 'Content-Type: application/json' \
--data '{
    "client_id": "c3133d76-a768-4f5a-XXX",
    "client_secret": "0ISL0DEC;UyYKB;riWRS0EXXX",
    "grant_type": "client_credentials",
    "scope": "surveys"
}'
```

### Response example

```json
{
  "access_token": "eyJhbGciOiJSIsImtpY5MTXXX.CNTcKWAUb2mTp2cZyiDRYYOtGCKXXX",
  "token_type": "bearer",
  "expires_in": 3600,
  "scope": "surveys"
}
```

## Using the access token

```shell
curl --location 'https://api.contentsquare.com/v1/public/projects/42/surveys' \
--header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

## Refresh your access token

The access token is valid for 1 hour. If you query the API with an expired or invalid token, you receive a `401 Unauthorized` error.

In case of an invalid token:

```json
{
  "success": false,
  "errorMessage": "Auth token is invalid.",
  "errorCode": "JWT_INVALID"
}
```

In case of an expired token:

```json
{
  "success": false,
  "errorMessage": "Auth token is expired.",
  "errorCode": "JWT_EXPIRED"
}
```

In that case, use your OAuth credentials (your `client_id` / `client_secret` pair) to request a new access token.

## Example of authentication flow

The following JavaScript code retrieves an access token and then uses it to list the surveys of a project:

```javascript
const authResponse = await fetch("https://api.contentsquare.com/v1/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: "<your_client_id>",
    client_secret: "<your_client_secret>",
    grant_type: "client_credentials",
    scope: "surveys",
  }),
});
const { access_token } = await authResponse.json();

const surveysResponse = await fetch("https://api.contentsquare.com/v1/public/projects/42/surveys", {
  headers: { Authorization: `Bearer ${access_token}` },
});
const { results, next_cursor } = await surveysResponse.json();
```


```json
{"@context":"https://schema.org","@type":"TechArticle","headline":"Authentication","description":"Authenticate to the Responses API with OAuth 2.0 client credentials and a bearer token.","url":"https://docs.contentsquare.com/fr/api/responses/authentication/","inLanguage":"en","dateModified":"2026-11-04T13:03:38+01:00","publisher":{"@type":"Organization","name":"Contentsquare","url":"https://www.contentsquare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://docs.contentsquare.com/#website","name":"Documentation technique Contentsquare","url":"https://docs.contentsquare.com/"}}
```