---
name: logs-router-retrieve-access-token
title: Retrieving an access token
description: You must get an IBM Cloud® Identity and Access Management (IAM) access token to authenticate your requests to the IBM® Cloud Logs Routing service.
last-updated: 2023-12-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/logs-router?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Retrieving an access token
{: #retrieve-access-token}

You must get an IBM Cloud® Identity and Access Management (IAM) access token to authenticate your requests to the IBM® Cloud Logs Routing service.
{: shortdesc}

## Retrieving an access token with the CLI
{: #retrieve-token-cli}
{: cli}

You can use the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started&format=markdown){: external} to quickly generate your personal Cloud IAM [access token](#x2113001){: term}.

1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started&format=markdown){: external}.

    ```sh
    ibmcloud login
    ```
    {: pre}

    If the login fails, run the `ibmcloud login --sso` command to try again. The `--sso` parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time pass code.
    {: note}

2. Run the following command to retrieve your IBM Cloud IAM access token and export it as an environment variable by running the following command:

    ```sh
    export IAM_TOKEN=`ibmcloud iam oauth-tokens --output json | jq -r '.iam_token'`
    ```
    {: pre}

## Retrieving an access token with the API
{: #retrieve-token-api}
{: api}

You can also retrieve your access token programmatically by first creating a [service ID API key](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&format=markdown){: external} for your application, and then exchanging your API key for an IBM Cloud IAM token.

1. Create a [service ID API key](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&format=markdown){: external}.

2. Call the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-api){: external} to retrieve your access token.

    ```sh
    $ curl -X POST \
        "https://iam.cloud.ibm.com/identity/token" \
        -H "content-type: application/x-www-form-urlencoded" \
        -H "accept: application/json" \
        -d 'grant_type=urn%3Aibm%3Aparams%3Aoauth%3Agrant-type%3Aapikey&apikey=<API_KEY>' > token.json
    ```
    {: codeblock}

    In the request, replace `<API_KEY>` with the API key that you created in the previous step. The following truncated example shows the contents of the `token.json` file:

    ```json
    {
        "access_token": "b3VyIGZhdGhlc...",
        "expiration": 1512161390,
        "expires_in": 3600,
        "refresh_token": "dGhpcyBjb250a...",
        "token_type": "Bearer"
    }
    ```
    {: screen}

Access tokens are valid for 1 hour, but you can regenerate them as needed.
{: note}