---
schema_version: "1"
id: 33c75c6e252c5c9031e4ffd68b16e19964b6c0d2bc7ad20e03f53a6b795ee26d
title: Authenticate with the Data Cloud Rest API
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-query-guide/references/data-cloud-query-api-reference/c360a-direct-api-connected-app.md
canonical_url: https://developer.salesforce.com/docs/data/data-cloud-query-guide/references/data-cloud-query-api-reference/c360a-direct-api-connected-app.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 47181aa2fc21f38c293695c61e1f791c63ab80b36d37e9534583fd4f41f2c5e0
products:
  - Data 360 Query Guide
  - Data 360 Developer Documentation
---
# Authenticate with the Data Cloud Rest API

Understand the prerequisites required to get started with the Data Cloud Rest API, also known as the Data Cloud Direct API.

## Create a Connected App

Set up a connected app to authenticate and request access to Data Cloud APIs. The connected app enables standard OAuth protocols for authentication and authorization. Follow the instructions in [Create a Connected App](https://help.salesforce.com/articleView?id=connected_app_create.htm&type=5), and configure the app as needed. In your connected app, select **Enable OAuth Settings** and the necessary OAuth scopes. The possible scopes are:

- `cdp_query_api`: Execute ANSI SQL queries against Data Cloud data.
- `cdp_profile_api`: Read and write Data Cloud profile and entity data.
- `refresh_token`: Obtain refresh tokens for offline access.
- `api`: Access Salesforce APIs (required for token exchange).

**important:** Your orgs must be provisioned with Data Cloud licenses and users must be assigned to appropriate roles to have full access to objects in Data Cloud. Refer to [User Roles and Permission Sets in Data Cloud](https://help.salesforce.com/s/articleView?id=data.c360_a_userpermissions.htm&type=5) before setting up the Connected App.

## Acquire the Access Token

Send a request to acquire the Salesforce access token. Here’s an example request.

```http
POST https://login.salesforce.com/services/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiIzTVZHOUFPcDRrYnJpWk9JZmg0eWZPQVlQUjFpYzJqb1JDQkhwZFZtaXBXU05sbXNwT2Vib1VtcWdMdHJIcDlRVFRQMGpWc3g0SHlzUW4xLk1SazFyIiwic3ViIjoic3VkaGVlckBvcmdtYWluMi5jb20iLCJhdWQiOiJodHRwOi8vc3VrdW1hci1sdG0uaW50ZXJuYWwuc2FsZXNmb3JjZS5jb20iLCJleHAiOjE2MDQ2Mzc4MTkyNTd9.WkEcmaGj_jhJpyFqXwEUtw-bkeXYuxkqc2c3lkwbGjg3GDo7sStITht_O_dSNanS0xk2q9ARA6Uom-uaiyNw_GGGK5L3jBQjK-ytrGumuJAsujjfSmLdYStxPVnjU2zyuPSWMQJmeDegxDgmeht3UQyluj0q4lX3rayx0Ol-vZfTuzr4YlxmdOKTNrPJCQ8h26uMSPFrQmmqcssrSg1DRgm3kMh15VKM3yZyNAg43EPw1BfncPWIxOmsGt2JxUUclBER3enTLM2cJKr9fDx16Ssesj2UKqXGbwN68gCF5rZxD6yGN5B0VeZIZVJrY5cTtExqBp3Lj8UOcqUj6esyCQ
```

**note:** Refer to [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm) for creating a JWT assertion.

**Response Format**

```json
{
  "access_token": "00Dxx0000006JFr!AQEAQL7SvQ1t..2yYtyM0jfXtMNriivdMpTYE3mThqATnm5YqPIX.xnzUC45zd0HEIU3tc9GdHLqWOFVprsgszWdYMPRUnOy",
  "scope": "cdpquery api cdpprofile",
  "instance_url": "https://yourorg.my.salesforce.com",
  "id": "https://yourorg.my.salesforce.com/id/00Dxx0000006JFrEAM/005xx000001X9hBAAS",
  "token_type": "Bearer"
}
```

Use the `access_token` and `instance_url` to get a Data Cloud token. The `instance_url` is where you post to get a Data Cloud token.

## Exchange the Access Token for a Data Cloud Token

After you've acquired the Salesforce access token, issue this request to get the Data Cloud access token to invoke the APIs.

```http
POST <instance_url>/services/a360/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:salesforce:grant-type:external:cdp&subject_token=<CORE_ACCESS_TOKEN>&subject_token_type=urn:ietf:params:oauth:token-type:access_token
```

**Response Format**

```json
{
  "access_token": "eyJraWQiOiJDT1JFLjAwRHh4MDAwMDAwNkpGci4xNjAzMjM5NzI2NjI5IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJodHRwOi8vc3VrdW1hci1sdG0uaW50ZXJuYWwuc2FsZXNmb3JjZS5jb206NjEwOS9pZC8wMER4eDAwMDAwMDZKRnJFQU0vMDA1eHgwMDAwMDFYOWhCQUFTIiwiYXVkIjoiYTM2MCIsInNjcCI6ImNkcHByb2ZpbGUgY2RwcXVlcnkiLCJuYmYiOjE2MDQ1NTE3NzYsInNmb2lkIjoiMDBEeHgwMDAwMDA2SkZyIiwiaXNzIjoiaHR0cDovL3N1a3VtYXItbHRtLmludGVybmFsLnNhbGVzZm9yY2UuY29tOjYxMDkvIiwic2Z1aWQiOiIwMDV4eDAwMDAwMVg5aEIiLCJleHAiOjE2MDQ1NTkwMjgsImlhdCI6MTYwNDU1MTgzNiwianRpIjoiYjk1ODA1ZDUtM2MzYS00MDNkLWJiNjgtNjBkNTJlNmM4OTBjIiwic2ZhcHBpZCI6IjNNVkc5QU9wNGticmlaT0lmaDR5Zk9BWVBSMWljMmpvUkNCSHBkVm1pcFdTTmxtc3BPZWJvVW1xZ0x0ckhwOVFUVFAwalZzeDRIeXNRbjEuTVJrMXIifQ.GAWqiPpVJoDig-adGtD4d5cO7L7JaIn2mOYH9GyDD7oO7Ayrsnv_k05QRPp-B1gSd4U8lqE_cuC0MTE9L6lzJA",
  "instance_url": "https://a360.cdp.cdp001.dev1-uswest2.aws.sfdc.cl",
  "token_type": "Bearer",
  "issued_token_type": "urn:ietf:params:oauth:token-type:jwt",
  "expires_in": 7191
}
```

You need three values from the response:

- `access_token`: The token used to access Data Cloud resources.
- `instance_url`: The tenant-specific endpoint where Data Cloud API requests are sent.
- `expires_in`: The number of seconds until the token expires and you must reauthenticate. Use this value as part of your access logic to avoid having to repeat the access steps for each call.

## Auto-Generated Endpoints

The Data Cloud application assigns a unique, system-generated endpoint to each of your organizations.

After you've acquired your endpoints in Data Cloud, use them for your organization's API calls. No other Data Cloud customer can use your endpoint for their API requests.

You can only use your endpoint with the **c360a.salesforce.com** endpoint structure.

## Revoke Access Tokens

When you need to revoke access tokens for security purposes or when decommissioning an application, you can revoke both the Salesforce access token and the Data Cloud token.

For detailed instructions on revoking tokens, see [Revoke OAuth Tokens](https://help.salesforce.com/articleView?id=remoteaccess_revoke_token.htm&type=5) in the Salesforce Help documentation.