---
schema_version: "1"
id: d244f05a7dfc4c99640e5f0059c995d5eee30d2b2142a5afc1376417e3bbc924
title: Generate the Access Token
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/service-cloud/messaging-byoc-ccaas/guides/generate-token.md
canonical_url: https://developer.salesforce.com/docs/service/messaging-byoc-ccaas/guide/generate-token.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: f488130484af8389762e86f00574a6b8d6e52ae3f768968a6738e26fbb73223c
products:
  - Bring Your Own Channel for CCaaS
  - Service Cloud Developer Content
---
# Generate the Access Token

Generate an access token for customers to use as the bearer token to make requests to the Interaction Service APIs. You must use a signed JSON Web Token (JWT) to generate the access token.

## Task 1: Copy the Consumer Key

Get the consumer key of the Interaction Service external client app (ECA) or connected app, depending on your implementation.

For an external client application:

1. From Setup in the Quick Find box, enter `External Client App Manager`, and then select **External Client App Manager**.
2. Select the external client app you created for your integration.
3. On the Settings tab, open the OAuth Settings section and click **Consumer Key and Secret**.
4. Verify your identity with the verification code sent to the email address of your Salesforce account.
5. Copy the consumer key.

For a connected app:

1. From Setup, in the Quick Find box, enter `App Manager`, and then select **App Manager**.
2. From the dropdown list to the right of the connected app you created for your integration, select **View**.
3. Click **Manage Consumer Details**.
4. Verify your identity with the verification code sent to the email address of your Salesforce account.
5. Copy the consumer key.

## Task 2: Generate the Signed JSON Web Token

Using your preferred method, such as [JWT.io](https://jwt.io/), generate a signed JWT.

1. For the header, set the `alg` header parameter to the `RSA256` hash algorithm.

   ```json
{
     "alg":"RS256",
     "typ":"JWT"
   }
```

2. For the payload, set these JWT claims:

   - `iss`: The consumer key of the connected app you created.
   - `sub`: The username of the Salesforce user account.
   - `aud`: The login URL for the Salesforce org.
   - `exp`: The expiry date and time for the token, measured in milliseconds since the Unix epoch.

   ```json
{
     "iss": "1ABC23DcEoFGHIJK4Lp5MN67mOonaPm8W9Cy1KKmnSBPwfZsyiPqTGA1g3ptgKgVsCHHP0x",
     "sub": "salesforce.user.account@example.com",
     "aud": "https://test.example.com",
     "exp": 1864241433000 //Set this value to the token's expiry date and time.
   }
```

3. For the signature, add the contents of your public and private keys in PEM format, making sure to include the respective headers and footers. You can find the public key in the `server.crt` file and the private key in the `server.key` file.

## Task 3: Generate the Access Token

Use the cURL command to create an access token, where `JWT` is the signed JWT you generated, and `OAUTH_AUTH_ENDPOINT` with the OAuth authorization endpoint, such as `https://login.salesforce.com/services/oauth2/token`.

```curl
curl --location --request POST -v OAUTH_AUTH_ENDPOINT --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" --data-urlencode "assertion=<JWT Token>"
```

Instead of using login.salesforce.com, you can also use the My Domain login URL, Experience Cloud site URL, or test.salesforce.com (for logging in to a sandbox) as the hostname in these endpoints. All endpoints require secure HTTP (HTTPS).

The resulting token has the format `{orgId}!{token}`. Share this token with your customers to use as the bearer token to make requests to the Interaction Service APIs.

**See Also**

- _Salesforce Help_: [OAuth Endpoints](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_endpoints.htm)