## Documentation Index

Fetch the complete documentation index at: [/llms.txt](https://developer.fabric.inc/llms.txt)

Use this file to discover all available pages before exploring further.

A system app uses OpenID Connect’s [Client Credential Flow](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4) to obtain an access token referred to as **system token**. Before starting, ensure the necessary app credentials and URLs are available as mentioned in the [Getting Started](https://developer.fabric.inc/v3/api-reference/authentication-v3/authentication-endpoints/fetch-access-token) guide.

### Getting system token

In the [Client Credential Flow](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4), get an access token by calling the `/token` endpoint:
```bash
curl --location --request POST '${Authorization Url}/v1/token' \
 --header 'accept: application/json' \
 --header 'authorization: Basic <base64(${client-id}:${client-secret})>' \
 --header 'cache-control: no-cache' \
 --header 'content-type: application/x-www-form-urlencoded' \
 --data-urlencode 'grant_type=client_credentials' \
 --data-urlencode 'scope=s2s'
```
The `authorization:` header in the request above is determined per [HTTP Basic Authentication](https://en.wikipedia.org/wiki/Basic%5Faccess%5Fauthentication) where the `client-id` and `client-secret` are used as _username_ and _password_, respectively. `Authorization Url` is a unique URL of each fabric merchant. It’s common across all system apps defined for a single merchant.

fabric Identity returns the access token in the following response:
```json
{
    "token_type": "Bearer",
    "expires_in": 600,
    "access_token": "eyJraWQiOiIt...",
    "scope": "s2s"
}
```
`access_token` is the system token generated by fabric Identity and is used by the system app for all subsequent fabric API calls. System token expiration is set to 10 minutes (600 seconds) by default. Once the token expires, the API client is expected to generate another access token using the same HTTP call shown above.

### Using system token

Upon receiving a valid access token, the API client can call any fabric API by specifying the `access_token` as the [Bearer token](https://datatracker.ietf.org/doc/html/rfc6750) in the `authorization` header:
```bash
curl --location --request GET '${fabric Endpoint Url}/v1/product' \
 --header 'accept: application/json' \
 --header 'authorization: Bearer ${access_token}' \
 --header 'cache-control: no-cache'
```