> For the complete documentation index, see [llms.txt](https://developer.stampede.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.stampede.ai/authentication.md).

# Authentication

For authenticating requests with Stampede, Bearer Tokens are included in the request headers to ensure secure and authorised access. You generate these tokens using OAuth 2.0 client credentials flow. Your requests must include the Bearer Token in the headers like this:

```markup
authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

⚠️ **Rate Limiting:** This endpoint operates a strict rate limit of **20 requests/minute**. To avoid rate limit errors, follow the token caching best practices outlined below.

### Generating a `client_id` & `client_secret`

You can generate a `client_id` & `client_secret` by heading to the [Stampede dashboard](https://product.stampede.ai/) > Marketplace > API Keys > Create New API Key.

From there, you'll be able to create a new `client_id` then in return will provide you with a `client_secret`. Keep it safe so it saves the hassle...

### Generating a Bearer Token using OAuth 2.0 Client Credentials

## Generate a Bearer Token

<mark style="color:green;">`POST`</mark> `https://global.stampede.ai/oauth/token`

#### Request Body

| Name                                             | Type   | Description         |
| ------------------------------------------------ | ------ | ------------------- |
| client\_id<mark style="color:red;">\*</mark>     | String |                     |
| client\_secret<mark style="color:red;">\*</mark> | String |                     |
| grant\_type<mark style="color:red;">\*</mark>    | String | client\_credentials |

{% tabs %}
{% tab title="200: OK " %}

```typescript
{
  "access_token": string,
  "expires_in": number,
  "token_type": "Bearer",
  "scope": "ALL:ALL"
}
```

{% endtab %}

{% tab title="400: Bad Request " %}

```typescript
{
    "error": string,
    "error_description": string
}
```

{% endtab %}
{% endtabs %}

### Examples

{% tabs %}
{% tab title="Curl" %}

```url
curl --location 'https://global.stampede.ai/oauth/token' \
--header 'Content-Type: application/json' \
--data '{
    "client_id": "ai.stampede.marketplace.example",
    "client_secret": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "grant_type": "client_credentials"
}'
```

{% endtab %}

{% tab title="NodeJs - Axios" %}

```javascript
const axios = require('axios')
let data = JSON.stringify({
  client_id: 'ai.stampede.marketplace.example',
  client_secret: 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX',
  grant_type: 'client_credentials',
})

let config = {
  method: 'post',
  maxBodyLength: Infinity,
  url: 'https://global.stampede.ai/oauth/token',
  headers: {
    'Content-Type': 'application/json',
  },
  data: data,
}

axios
  .request(config)
  .then((response) => {
    console.log(JSON.stringify(response.data))
  })
  .catch((error) => {
    console.log(error)
  })
```

{% endtab %}

{% tab title="PHP - Guzzle" %}

```php
<?php
$client = new Client();
$headers = [
  'Content-Type' => 'application/json'
];
$body = '{
  "client_id": "ai.stampede.marketplace.example",
  "client_secret": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "grant_type": "client_credentials"
}';
$request = new Request('POST', 'https://global.stampede.ai/oauth/token', $headers, $body);
$res = $client->sendAsync($request)->wait();
echo $res->getBody();

```

{% endtab %}

{% tab title="Python - http.client" %}

```python
import http.client
import json

conn = http.client.HTTPSConnection("global.stampede.ai")
payload = json.dumps({
  "client_id": "ai.stampede.marketplace.example",
  "client_secret": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "grant_type": "client_credentials"
})
headers = {
  'Content-Type': 'application/json'
}
conn.request("POST", "/oauth/token", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
```

{% endtab %}
{% endtabs %}

### Token Caching & Expiry

**Important:** Tokens have an expiry time (indicated by the `expires_in` field in the response). Instead of requesting a new token for every API call, you should **cache your token securely and reuse it until it expires**. This significantly reduces requests to the authentication endpoint and helps you stay well within rate limits.

**Best practices:**

* **Cache the token** in your application's memory or a secure cache (e.g., Redis)
* **Monitor the expiry time** - refresh the token only when it approaches expiration
* **Reuse tokens** across multiple API requests until they expire
* **Handle expiration gracefully** - if a request returns an authentication error, obtain a fresh token and retry
* **Secure your cache** - treat cached tokens as sensitive as your `client_secret` and ensure proper access controls


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://developer.stampede.ai/authentication.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.