---
name: AnalyticsEngine-Retrieve-IAM-access-token-testserver
title: Retrieving IAM access tokens
description: ''
last-updated: 2021-05-05
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/AnalyticsEngine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:new_window: target="_blank"}
{:shortdesc: .shortdesc}
{:codeblock: .codeblock}
{:screen: .screen}
{:pre: .pre}
{:tip: .tip}
{:note: .note}
{:important: .important}

# Retrieving IAM access tokens
{: #retrieve-iam-token-serverless}

Get started with the IBM Analytics Engine API by authenticating your requests to the service with an IBM Cloud® Identity and Access Management (IAM) access token.

An access token is a temporary credential that expires after 1 hour. After the acquired token expires, you must generate a new token to continue calling the IBM Analytics Engine API. To maintain access to the service, regenerate the access token for your API key on a regular basis.
{: important}

The recommended method to retrieve a token programmatically is to create an API key for your IBM Cloud® ID and then use the IAM token API to exchange that key for a token.

You can create a token in two ways:

- [By using the IBM Cloud REST API](#create-token-with-ibm-cloud-rest-api)
- [By using the IBM Cloud® CLI](#create-token-with-ibm-cloud-cli)

## Create a token using the IBM Cloud REST API
{: #create-token-with-ibm-cloud-rest-api}

To create a token in IBM Cloud:

1. [Sign in to IBM Cloud](https://cloud.ibm.com) and select **Manage>Security>Platform API Keys**.
1. Create an API key for your own personal identity, copy the key value, and save it in a secure place. After you leave the page, you will no longer be able to access this value.
1. Use the API key you created with the IAM identity token API to generate an IAM token. For example:

    ```sh
    curl -X POST \
    'https://iam.cloud.ibm.com/identity/token' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=<your iam api key>'
    ```
    {: codeblock}

    For details on the API syntax, see [IAM identity token API](https://cloud.ibm.com/apidocs/iam-identity-token-api#create-an-iam-access-token-for-a-user-or-service-i).

    This is a sample of what is returned:
    ```json
    {
       "access_token": "eyJraWQiOiIyMDE3MDgwOS0wMDowMDowMCIsImFsZyI6…",
       "refresh_token": "zmRTQFKhASUdF76Av6IUzi9dtB7ip8F2XV5fNgoRQ0mbQgD5XCeWkQhjlJ1dZi8K…",
       "token_type": "Bearer",
       "expires_in": 3600,
       "expiration": 1505865282
    }
    ```

1. Use the value of the `access_token` property for your IBM Analytics Engine API calls. Set the `access_token`  value as the authorization header parameter for requests to the IBM Analytics Engine APIs. The format is `Authorization: Bearer <access_token_value>`.

    For example:
    ```text
    Authorization: Bearer eyJraWQiOiIyMDE3MDgwOS0wMDowMDowMCIsImFsZyI6IlJTMjU2In0...
    ```

## Create a token using the IBM Cloud CLI
{: #create-token-with-ibm-cloud-cli}

Before you can create a token by using the IBM Cloud CLI, check that you have met the following prerequisites:

1. You have a valid IBMid.
1. You have downloaded and installed the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli&format=markdown).


To create a token using IBM Cloud CLI:

1. Log in to the IBM Cloud CLI:

    ```sh
    ibmcloud api https://cloud.ibm.com
    ibmcloud login <enter your credentials>
    ```
    {: codeblock}

    If you have multiple IBM Cloud accounts, you'll be asked to choose an account for the current session. Also, you'll need to choose an organization and space in IBM Cloud.

2. Fetch the IAM access token:
    ```sh
    ibmcloud iam oauth-tokens
    ```
    {: codeblock}

    The output returns the IAM token.

    When you use the token, remove `Bearer` from the value of the token that you pass in API calls.
    {: note}