---
schema_version: "1"
id: eccd72cdcf5dbbc6a061dec2a7857ea4c2ccabe52abd7d6a88c0eafafed127a0
title: Obtaining an API Bearer Token Using a SAML Assertion
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/saml-bearer-token.md
canonical_url: https://docs.mulesoft.com/access-management/saml-bearer-token
source_site: docs.mulesoft.com
content_type: documentation
content_hash: d1ffa3fa7b500a4d72630b0c91f083405941df60c8476752074e6177bff666bb
description: MuleSoft Documentation Site
latest: true
---
---
product: Access Management
version: master
---

# Obtaining an API Bearer Token Using a SAML Assertion

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Use a SAML 2.0 IdP-initiated SSO assertion to obtain an API bearer token for Anypoint Platform APIs
so federated users within your organization can use the token to access Anypoint Platform APIs.

> [!NOTE] Obtaining an API bearer token using a SAML assertion works only for SSO flows that are
> initiated from an Identity Provider (IdP). Service provider-initiated SSO doesn’t support
> unsolicited assertions. For more information, see
> [Initiate the SSO Flow with an Identity Provider](#idp-initiated-sso).

The bearer token provides access to the platform APIs a user has permission to access. Each bearer
token is associated with a specific user who is granted roles and permissions for an API. If a user
attempts to access an API that they do not have permissions to access the API returns a
`401 Unauthorized` error.

The validity of the bearer token is determined by the value defined for the Default Session Timeout
property. This is configured in the root organization properties. See
[Manage Root Business Group Settings](https://docs.mulesoft.com/access-management/managing-business-groups#manage-root-org-settings) for more
information.

## Initiate the SSO Flow with an IdP

To successfully exchange a SAML assertion for an API bearer token, make sure your SSO flow is
initiated from the IdP and not the service provider (SP).

<table><colgroup><col> <col> <col></colgroup><thead><tr><th></th><th>SP-Initiated (Standard Login)</th><th>IdP-Initiated (Assertion Exchange)</th></tr></thead><tbody><tr><td><p>Starting point</p></td><td><p>Anypoint Platform signin page</p></td><td><p>IdP portal or custom script</p></td></tr><tr><td><p>InResponseTo</p></td><td><p>Required</p></td><td><p>Must be empty</p></td></tr><tr><td><p>Use case</p></td><td><p>User signs in on the Anypoint Platform signin page</p></td><td><p>CLI, scripts, automation</p></td></tr><tr><td><p>Result</p></td><td><p>Browser cookie</p></td><td><p>Bearer token</p></td></tr></tbody></table>

- Launch Anypoint Platform from your IdP’s portal or use the IdP’s IdP-initiated SSO URL that’s
  configured for the Anypoint Platform application.

- Don’t start the SSO flow from Anypoint Platform URLs such as `/accounts/login`, deep links, or
  bookmarks to Anypoint Platform services. Those paths won’t produce an assertion that can be
  exchanged for a bearer token.

- Check the `<samlp:Response>` element to ensure it doesn’t include an `InResponseTo` attribute.
  IdP-initiated responses are unsolicited and must have an empty `InResponseTo`, for example:

  ```xml
  <samlp:Response
      xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
      <!-- IdP-initiated example: note there is NO InResponseTo attribute on the Response -->
      <saml:Issuer>https://idp.example.com</saml:Issuer>
      <!-- ... -->
  </samlp:Response>
  ```

  If `InResponseTo` is present, the exchange fails with an error similar to:
  `Unauthorized: IDP-initiated SSO – InResponseTo: must be empty`.

## Obtain an API Bearer Token Using a SAML Assertion

Use an IdP-initiated SAML response to obtain an API bearer token for Anypoint Platform. Capture the
Base64-encoded SAML response from your IdP and POST it to the Anypoint Platform token endpoint to
receive the token.

1.  Obtain a SAML response for your identity provider as described in
    [View a SAML Response in Your Browser](https://docs.mulesoft.com/access-management/troubleshoot-saml-assertions-task).

    Record this response to use in the following step.

2.  Obtain the bearer token by running the following `curl` command. Replace `<SAML_RESPONSE>` in
    this example with the SAML response you obtained in the previous step.

    > [!NOTE] The SAML response must be Base64-encoded. If the SAML response string is URL encoded,
    > you must decode the string before running the `curl` command.

    curl -X POST \\
    https://anypoint.mulesoft.com/accounts/login/:org-domain/providers/:providerId/receive-id \\ -H
    'Content-Type: application/json' \\ -H 'X-Requested-With: XMLHttpRequest' \\ -d '{
    "SAMLResponse": "<SAML\_RESPONSE>" }'

After obtaining the bearer token federated users within your organization can use it to access an
API. For example, you can access the API using one of the following methods:

- **Anypoint CLI**: A user can access a platform API by supplying the `-bearer` option to the
  `anypoint-cli` command. See [Anypoint CLI](https://docs.mulesoft.com/anypoint-cli/latest/#authentication) for more
  information.

- **curl**: A user can access a platform API by passing the bearer token when accessing an API
  endpoint as shown in the following:

  curl -X GET \\ https://anypoint.mulesoft.com/accounts/api/me \\ -H 'Authorization: Bearer
  <BEARER\_TOKEN>'

## See Also

- [Managing Business Groups in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-business-groups)

- [Anypoint CLI Overview](https://docs.mulesoft.com/anypoint-cli/latest/)

- [View a SAML Response in the Browser](https://docs.mulesoft.com/access-management/troubleshoot-saml-assertions-task)