---
schema_version: "1"
id: 9213d48cecd3fa174c5911bd8706ac29087baf3d4bfac0196088eec598b5bd2b
title: "Step 2: Generate an Access Token"
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/service-cloud/messaging-byob/guides/generate-access-token.md
canonical_url: https://developer.salesforce.com/docs/service/messaging-byob/guide/generate-access-token.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 43fad654ca0ec03eae2eb02796ee85a115986c19f85da3b83ad76864ad2cba96
products:
  - Bring Your Own Bot for Messaging
  - Service Cloud Developer Content
---
# Step 2: Generate an Access Token

1. From Setup, in the Quick Find box, enter `External Client App Manager`, and then select the app you created.
2. Click the **Settings** tab, and go to the OAuth Settings section.
3. Click **Consumer Key and Secret**. A browser tab opens up for entering the verification code.
4. In the new browser tab, verify your identity with the verification code sent to the email address of your Salesforce account.
5. Copy the consumer key.
6. Generate the Signed JSON Web Token. You can use your preferred method, such as [JWT.io](https://jwt.io/) to generate a signed JWT.

   1. **JWT Header:** Set `alg` to the RS256 hash algorithm.

      ```json
{ "alg":"RS256", "typ":"JWT" }
```

   2. **JWT Payload:** Set these claims:

      - `iss`: The consumer key of the connected app.
      - `sub`: The username of the Salesforce user account. You can click the Salesforce profile icon at top-right, and then click **Settings**, to find the username.
      - `aud`: The instance login URL. For example, for falcon environment, use `https://login.test1.pc-rnd.salesforce.com/`, and for local environment use `https://localhost:6101/`.
      - `exp`: The expiry date and time of the token in milliseconds since the Unix epoch. You can use an Epoch Converter available online to generate this value.

      ```json
{
        "iss": "1ABC23DcEoFGHIJK4Lp5MN67mOonaPm8W9Cy1KKmnSBPwfZsyiPqTGA1g3ptgKgVsCHHP0x",
        "sub": "salesforce.user.account@example.com",
        "aud": "https://test.example.com",
        "exp": "1688515200000"
      }
```

   3. **Signature:** Add public and private keys in PEM format, including the respective headers and footers from the `server.crt` and `server.key` files. Copy the verified signature.

7. Generate the access token.

   To generate the access token, use a cURL command that includes the signed JWT and the OAuth authorization endpoint (`OAUTH_AUTH_ENDPOINT`), which is typically your instance URL followed by `/services/oauth2/token` (`https://login.salesforce.com/services/oauth2/token` or `https://login.test1.pc-rnd.salesforce.com/services/oauth2/token` for test1 environments).

:**note:** The `OAUTH_AUTH_ENDPOINT` value should match the `aud` (audience) value in your JWT.:

Also, instead of using `login.salesforce.com`, you can use the My Domain, Experience Cloud site, or `test.salesforce.com` (sandbox) domain in these endpoints. For hostname, use the My Domain, Experience Cloud site, or custom URL. All endpoints require secure HTTP (HTTPS).

In the cURL command, replace `OAUTH_AUTH_ENDPOINT` with the appropriate URL and JWT with the verified signature you obtained from [JWT.io](https://jwt.io/). Use your terminal to execute the command to generate the access token.

```bash
curl --location 'https://<YOUR_AUDIENCE_URL>/services/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'assertion=<YOUR_SIGNED_JWT_ASSERTION>' \
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer'
```

The resulting token is in the `{orgId}!{token}` format. Share this with your customers as the bearer token.

## Next Steps

After you generate the access token, [create a platform event and assign permissions](https://developer.salesforce.com/docs/service/messaging-byob/guide/create-platform-event.md).