---
schema_version: "1"
id: 2107b44f5a5a79e675c92854b052040485324a376a96dbe0c4bc293fbc2aa6a8
title: Generate an OAuth Token Using Your Key
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/einstein-vision-language/einstein/guides/Work-With-Tokens/generate-an-oauth-token-using-your-key.md
canonical_url: https://developer.salesforce.com/docs/analytics/einstein-vision-language/guide/generate-an-oauth-token-using-your-key.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 82f5a9b403c4b10285a9c3e90eb2d72e7e4f89b74a26981832a750a332dd8e3b
products:
  - Einstein Vision and Language
  - Einstein Vision and Language Repo
---

# Generate an OAuth Token Using Your Key

When you sign up for an account, you download your key contained in a file called einstein_platform.pem. You can quickly get a token using the [token page](https://api.einstein.ai/web/token) and uploading your key.

In code, however, you must programmatically get an OAuth token using your key. You do this by generating an assertion and then passing that to the API to get an access token. That access token can then be used to make API calls.

1. Open the `einstein_platform.pem` file and read in the key contents.

2. Create the JWT payload. The payload is JSON that contains:

- `sub`—Your Einstein Vision and Language username. You can find your username in the welcome email you receive after you get an account. If you signed up using Salesforce, your username is the email address associated with the org you signed up with.

- `aud`—The API endpoint URL for generating a token.

- `exp`—The expiration time in Unix time. This value is the current Unix time in seconds plus the number of seconds you want the token to be valid. For testing purposes, you can get the Unix time at [Time.is](https://time.is/Unix_time_now).

The JWT payload looks like this JSON.

```json
{
  "sub": "<EINSTEIN_PLATFORM_SERVICES_USERNAME>",
  "aud": "https://api.einstein.ai/v2/oauth2/token",
  "exp": <EXPIRATION_SECONDS_IN_UNIX_TIME>
}
```

3. Sign the JWT payload with your RSA private key to generate an assertion. The private key is contained in the `einstein_platform.pem` file you downloaded when you signed up for an account. The code to generate the assertion varies depending on your programming language. If you're doing manual testing, you can generate an assertion using [jwt.io](https://jwt.io/).

4. Call the API and pass in the assertion. You pass in all the necessary data in the `-d` parameter. Replace `<ASSERTION_STRING>` with the assertion you generated. This cURL command shows the call.

```cURL
curl -H "Content-type: application/x-www-form-urlencoded" -X POST https://api.einstein.ai/v2/oauth2/token -d "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<ASSERTION_STRING>"
```

The response looks similar to this JSON.

```json
{
  "access_token": "EPMSDXBQSG6YH23HUE6VTA2UC53MBOEFTUND7QWVQIFOAZU42BGIK3SIXKGEWYPKO3GUFLCLHX5ZBMPPQIB6DCP2NAT7HQ108TLRQ7A",
  "token_type": "Bearer",
  "expires_in": "120"
}
```

5. Use the access token to make an API call. For example, this cURL command to get a dataset.

```cURL
curl -X GET -H "Authorization: Bearer EPMSDXBQSG6YH23HUE6VTA2UC53MBOEFTUND7QWVQIFOAZU42BGIK3SIXKGEWYPKO3GUFLCLHX5ZBMPPQIB6DCP2NAT7HQ108TLRQ7A" -H "Cache-Control: no-cache" https://api.einstein.ai/v2/vision/datasets/1008108
```

Use the access token to make any authenticated API calls as long as the token is valid (it's not expired). When the access token expires, you repeat this process to generate a new one.