6. Get an access token

The gateway accepts short-lived OAuth 2.0 bearer tokens issued via the client-credentials grant. You exchange the client_id / client_secret from the previous step for an access_token, then send that token on every API call.

Request a token

When you created your client (previous step), the console showed a "Get a token" command already filled in with your client_id and client_secret — you can copy that directly. The equivalent request looks like this:

curl --request POST \
  --url https://api-stg.uhg.com/oauth2/token \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data 'scope=https://ai-gateway.optum.com/.default'

The response contains the token and its lifetime:

{
  "access_token": "eyJraWQiOi...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Using and refreshing the token

• Send it as Authorization: Bearer <access_token> on every gateway request.
• Tokens are short-lived (typically one hour). Cache the token and request a new one shortly before expires_in elapses — don't fetch a fresh token per call.
• The token identifies your OAuth client to the gateway, which maps it to your organization and checks model access.

Note: the token endpoint, scope, and gateway hostnames are environment-specific. The values above are for the non-production environment; use the ones your platform administrator provides.

With a token in hand, you're ready to call a model.