> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thanx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Guest Token

> This endpoint mints a short-lived guest access token from your Merchant-owned OAuth app credentials, for applying a Universal Promo Code to a basket without an end-user.

> [!WARNING]
>
> Guest Universal Promo Codes must be enabled for your account by Thanx. See
> [Guest Universal Promo Codes](https://docs.thanx.com/loyalty/guest-promo-codes.md) for the full flow.

Send your Merchant-owned OAuth app's `client_id` / `client_secret` in the JSON
request body, the same way you call [Acquire Access Token](https://docs.thanx.com/consumer/sso/acquire-access-token.md).
No `Merchant-Key` header is needed for this call. This route is served under
`/loyalty-api/`, not `/api/`.

Reuse a token until it expires instead of minting one per basket.

### Parameters

**grant\_type** `string` *required*

Must be `client_credentials`.

**client\_id** `string` *required*

Your Merchant-owned OAuth app's Client ID

**client\_secret** `string` *required*

Your Merchant-owned OAuth app's Client Secret

> [!NOTE]
>
> HTTP Basic `client_id:client_secret` is also accepted; when an
> `Authorization: Basic` header is sent, it is used instead of the body. Never
> send the credentials in the URL query string — that returns `invalid_client`.

### Response

**access\_token** `string`

The guest Bearer token, for use on [Create & Update Basket](https://docs.thanx.com/loyalty/create-update-basket.md).

**token\_type** `string`

The type of token, `Bearer`

**expires\_in** `integer`

Token lifetime in seconds. Currently `1800` (30 minutes). There is no refresh
token — re-mint a new guest token once the current one expires.

**scope** `string`

The OAuth scopes configured on your app. This echoes your app's own
configuration and varies per integration.

### Errors

| Condition | Status | Response |
| - | - | - |
| Unknown `client_id`, wrong `client_secret`, credentials sent in the query string, or an app that is not Merchant-owned | 401 | `invalid_client` |
| `grant_type` is not `client_credentials` | 401 | `unsupported_grant_type` |
| Guest Universal Promo Codes not enabled for the app's merchant | 404 | `{"code": 404, "message": "The requested service is unavailable"}` |

```bash theme={null}
curl https://loyalty.thanxsandbox.com/loyalty-api/oauth/token \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "${client_id}",
    "client_secret": "${client_secret}"
  }'
```

```json 201 theme={null}
{
  "access_token": "945148251b603ae34561d90acfe4050e67494d6d1e65d4d3d52798407f03c0bd",
  "token_type": "Bearer",
  "expires_in": 1800,
  "scope": "passwordless v3"
}
```

```json 401 Invalid client theme={null}
{
  "error": "invalid_client",
  "error_description": "Invalid Client ID / Secret",
  "error_uri": null
}
```

```json 401 Unsupported grant type theme={null}
{
  "error": "unsupported_grant_type",
  "error_description": "Only client_credentials grant_type is supported",
  "error_uri": null
}
```

```json 404 Not enabled theme={null}
{
  "code": 404,
  "message": "The requested service is unavailable"
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.