---
title: "How do I obtain and use a short-lived API access token from Okta?"
slug: "how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta"
tags: ["API access token", "client secret", "LUSID API", "SDK"]
updated: 2025-08-21T11:58:17Z
published: 2025-08-21T11:58:17Z
canonical: "support.lusid.com/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I obtain and use a short-lived API access token from Okta?

Every call made to the LUSID API must be authorised by an [API access token](/v1/docs/what-are-an-api-access-token-and-a-client-secret).

There are two types of API access token. The recommended and most secure option is to obtain a short-lived OAuth2.0-compliant token on demand from LUSID’s identity provider, Okta, or [your own identity provider](/v1/docs/how-do-i-configure-lusid-to-use-a-different-api-access-token-issuer). (The less-secure alternative is a long-lived [personal access token](/v1/docs/what-is-a-personal-access-token).)

To obtain a short-lived API access token from Okta, you require:

- The username and password of a LUSID user account. Typically these are the credentials of a [service user](/v1/docs/how-do-i-set-up-a-service-user-account) set up to own the application or service calling the LUSID API, but it can alternatively be the credentials of a [personal user](/v1/docs/how-do-i-set-up-a-personal-user-account). In either case, these credentials are specified when the account is created.
- A client ID and client secret. [See how to generate these](/v1/docs/how-do-i-generate-and-reveal-a-client-secret).
- Okta’s dedicated token URL for your LUSID domain. [See how to look this up](/v1/docs/how-do-i-generate-and-reveal-a-client-secret#view).

To call the LUSID REST API directly:

1. Make a POST request to your dedicated Okta token URL, passing in the username, password, client ID and client secret, suitably encoded:

```json
curl -X POST <your-okta-token-url>
   -H "Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1"
   --data-urlencode grant_type="password"
   --data-urlencode username="<your-username>"
   --data-urlencode password="<your-password>"
   --data-urlencode scope="openid client groups"
   --data-urlencode client_id="<your-client-id>"
   --data-urlencode client_secret="<your-client-secret>"
```

The response from Okta contains 2 tokens (actual data shortened for brevity):

```json
{
   "token_type": "Bearer",
   "expires_in": 3600,
   "access_token": "eyJraWQiOiJvZDFzeFk4WTlPalMyZ2dZT3VidVBYT2dRX0dURkcwZ1...wmlxPjh49DYeEuh_w4vt2Q",
   "scope": client groups openid",
   "id_token": "eyJraWQiOiJvZDFzeFk4WTlPalMyZ2dZT3VidVBYT2dzeFk4WTlPalMKi8...Mh66mG9j7zfyQxsp7UPC4J"
}
```
2. Extract the first token, keyed `access_token` and ending `wmlxPjh49DYeEuh_w4vt2Q` in this example.
3. Supply this API access token as a Bearer token in the Authorization HTTP header of a call to the LUSID API, for example:

```json
curl -X GET https://<your-domain>.lusid.com/api/api/instruments 
   -H "Authorization: Bearer eyJraWQiOiJvZDFzeFk4WTlPalMyZ2dZT3VidVBYT2dRX0dURkcwZ1...wmlxPjh49DYeEuh_w4vt2Q"
```

Note the process of obtaining and using an API access token is different if you are [using the LUSID SDK](/v1/docs/how-do-i-use-an-api-access-token-with-the-lusid-sdk).