# Step 2: Generate an Access Token

1. From Setup, in the Quick Find box, enter `External Client App Manager`, and then select the app you created.

2. Click the **Settings** tab, and go to the OAuth Settings section.

3. Click **Consumer Key and Secret**. A browser tab opens up for entering the verification code.

4. In the new browser tab, verify your identity with the verification code sent to the email address of your Salesforce account.

5. Copy the consumer key.

6. Generate the Signed JSON Web Token. You can use your preferred method, such as [JWT.io](https://jwt.io/) to generate a signed JWT.

   1. **JWT Header:** Set `alg` to the RS256 hash algorithm.

      ```sfdocs-code {"lang":"json", "title": "JWT Header"}
      { "alg":"RS256", "typ":"JWT" }
      ```

   2. **JWT Payload:** Set these claims:

      - `iss`: The consumer key of the connected app.
      - `sub`: The username of the Salesforce user account. You can click the Salesforce profile icon at top-right, and then click **Settings**, to find the username.
      - `aud`: The instance login URL. For example, for falcon environment, use `https://login.test1.pc-rnd.salesforce.com/`, and for local environment use `https://localhost:6101/`.
      - `exp`: The expiry date and time of the token in milliseconds since the Unix epoch. You can use an Epoch Converter available online to generate this value.

      ```sfdocs-code {"lang":"json", "title": "JWT Payload"}
      {
        "iss": "1ABC23DcEoFGHIJK4Lp5MN67mOonaPm8W9Cy1KKmnSBPwfZsyiPqTGA1g3ptgKgVsCHHP0x",
        "sub": "salesforce.user.account@example.com",
        "aud": "https://test.example.com",
        "exp": "1688515200000"
      }
      ```

   3. **Signature:** Add public and private keys in PEM format, including the respective headers and footers from the `server.crt` and `server.key` files. Copy the verified signature.

7. Generate the access token.

   To generate the access token, use a cURL command that includes the signed JWT and the OAuth authorization endpoint (`OAUTH_AUTH_ENDPOINT`), which is typically your instance URL followed by `/services/oauth2/token` (`https://login.salesforce.com/services/oauth2/token` or `https://login.test1.pc-rnd.salesforce.com/services/oauth2/token` for test1 environments).

:::note
The `OAUTH_AUTH_ENDPOINT` value should match the `aud` (audience) value in your JWT.
:::

Also, instead of using `login.salesforce.com`, you can use the My Domain, Experience Cloud site, or `test.salesforce.com` (sandbox) domain in these endpoints. For hostname, use the My Domain, Experience Cloud site, or custom URL. All endpoints require secure HTTP (HTTPS).

In the cURL command, replace `OAUTH_AUTH_ENDPOINT` with the appropriate URL and JWT with the verified signature you obtained from [JWT.io](https://jwt.io/). Use your terminal to execute the command to generate the access token.

```sfdocs-code {"lang":"bash", "title": "Generate Access Token"}
curl --location 'https://<YOUR_AUDIENCE_URL>/services/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'assertion=<YOUR_SIGNED_JWT_ASSERTION>' \
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer'
```

The resulting token is in the `{orgId}!{token}` format. Share this with your customers as the bearer token.

## Next Steps

After you generate the access token, [create a platform event and assign permissions](/docs/service/messaging-byob/guide/create-platform-event.md).