---
schema_version: "1"
id: cf6599d4404af87281d7077852e283172ba40e3c78cbccb7ab7503a19ee26a5c
title: Get an Access Token for Legacy Packages
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/guides/mc-getting-started/get-access-token.md
canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/get-access-token.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: d1acc8fd973134a8232ad83e8bd301347e39e96f974b4fce21763f2663089c64
products:
  - Marketing Cloud Engagement APIs and Programmatic Languages
  - Marketing Cloud
---
# Get an Access Token for Legacy Packages

The first step in any API-based integration is getting an OAuth access token to authenticate your calls. This information applies only to API integrations in legacy packages. To get an access token for OAuth 2.0 API integrations, review [Set Up Your Development Environment for Enhanced Packages](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/mc-dev-setup-enhanced.md).

Using the client ID and secret from the installed package, call the Auth service to obtain an OAuth access token for authenticating your API calls. This sample call demonstrates how to POST to that resource to acquire an access token.

```js
POST https://YOUR_SUBDOMAIN.auth.marketingcloudapis.com/v1/requestToken
Content-Type: application/json
{
    "clientId": "YOUR_CLIENT_ID",
    "clientSecret": "YOUR_CLIENT_SECRET"
}
```

The response contains your access token.

```js
200 OK
{
    "accessToken": "YOUR_ACCESS_TOKEN"
    "expiresIn": 3600
}
```

Specify the access token to authenticate all other REST API calls via the `Authorization` header field with the `Bearer` HTTP authorization scheme.

```
GET https://www.YOUR_SUBDOMAIN.rest.marketingcloudapis.com/platform/v1/endpoints
Accept: application/json
Authorization: Bearer YOUR_ACCESS_TOKEN
```

This example uses the same access token to authenticate with the SOAP API.

```xml
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
    <s:Header>
        <h:fueloauth xmlns="http://exacttarget.com"
                        xmlns:h="http://exacttarget.com">
            YOUR_ACCESS_TOKEN
        </h:fueloauth>
    </s:Header>
    ...
</s:Envelope>
```

## Refresh an Access Token

Access tokens expire one hour after they're issued. If you attempt to use an expired token, you receive a `401 Unauthorized` HTTP response. If this happens, refresh your access token by calling `requestToken` again.

## Important Considerations

Follow these considerations when using the API.

1.  Don't request a new access token for every API call you make. Each access token is good for an hour and is reusable. Making two API calls for every one operation is inefficient and can lead to throttling.
2.  Keep your credentials secure. Never expose your client ID or secret on the client side or store them in a mobile app.

## Related Items

- [requestToken Reference](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/requestToken.md)
- [Your Subdomain and Your Tenant's Endpoints](https://developer.salesforce.com/docs/marketing/marketing-cloud/mc-apis/your-subdomain-tenant-specific-endpoints.md)