# requestToken Reference for Legacy Packages

This document applies only to API integrations in legacy packages. To get an access token for OAuth 2.0 API integrations, review [Set Up Your Development Environment for Enhanced Packages](/docs/marketing/marketing-cloud/guide/mc-dev-setup-enhanced.md).

For your authentication requests, we recommend that you use a tenant-specific endpoint, which includes your tenant’s subdomain. Find your endpoints in Installed Packages. New and existing customers on S1 through S10 can continue to use `https://auth.exacttargetapis.com`.

To obtain an OAuth token, perform an HTTP POST that includes your client ID and client secret in the request body.

## Query Parameters

| Name     | Type    | Description                        |
| -------- | ------- | ---------------------------------- |
| `legacy` | Boolean | Set to 1 to return a legacy token. |

## JSON Parameters

The JSON object in the request body has these properties.

| Name           | Type Description |                                                                                                                                                                                                                                                                    |
| -------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `clientID`     | String           | Required. The ID for a Client Credentials App Key pair.                                                                                                                                                                                                            |
| `clientSecret` | String           | Required. The client secret for the Client Credentials App Key pair.                                                                                                                                                                                               |
| `accessType`   | String           | Set to `offline` to return a refresh token.                                                                                                                                                                                                                        |
| `refreshToken` | String           | An access token that is contextualized for your app. Refresh tokens are valid for up to 700 days and can be used only one time. Each token has a 5-minute revocation period after use, allowing for more attempts in case the service doesn't respond immediately. |

## Example Request for Production

```json
//Request token for a Production environment https://mc.exacttarget.com.

POST https://YOUR_SUBDOMAIN.auth.marketingcloudapis.com/v1/requestToken
Content-Type: application/json
{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET"
}
```

## Example Request for Testing

```json
//Request token for a Production Support (sandbox) environment https://mc.test.exacttarget.com.

POST https://auth-test.exacttargetapis.com/v1/requestToken
Content-Type: application/json
{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET"
}
```

## Example Response

The HTTP POST with valid values for clientID and clientSecret returns two values:

1. **accessToken** - An OAuth token passed to subsequent API requests.
2. **expiresIn** - The expiration period of the OAuth token in seconds. The default value of 3600 seconds cannot be changed.

```json
{
  "accessToken": "YOUR_TOKEN",
  "expiresIn": 3600
}
```

## Example Request for SSO

```json
//Request token for an app.

POST https://YOUR_SUBDOMAIN.auth.marketingcloudapis.com/v1/requestToken
Content-Type: application/json
{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "refreshToken": "YOUR_TOKEN",
  "accessType": "offline"
}
```

## Example Response for SSO

```json
{
  "accessToken": "YOUR_ACCESS_TOKEN",
  "expiresIn": 3600,
  "refreshToken": "YOUR_REFRESH_TOKEN"
}
```

## Related Items

- [SSO for Marketing Cloud Engagement Apps](/docs/marketing/marketing-cloud/guide/single-sign-on.md)
- [Your Subdomain and Your Tenant's Endpoints](/docs/marketing/marketing-cloud/guide/your-subdomain-tenant-specific-endpoints.md)
- *Salesforce Help*: [Determine Your Marketing Cloud Engagement Instance](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_determine_your_marketing_cloud_instance.htm)