> ## Documentation Index
> Fetch the complete documentation index at: https://help.lobyco.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Lobyco tenant authentication using client credentials flow​

> Lobyco creates the Azure app registration and shares credentials with you. Best if you do not run your own Azure AD.

## Auth configuration

Reach out to Lobyco to get following configuration values for authentication:

* `client_app_id`
* `client_app_secret`
* `client_tenant_id`
* `lobyco_app_uri`

## How to get token

To get a token by using the client credentials flow, send a POST request to the `/token` endpoint of Microsoft identity platform:

```http theme={"system"}
POST /{client_tenant_id}/oauth2/v2.0/token HTTP/1.1           
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id={client_app_id}
&scope={lobyco_app_uri}.default
&client_secret={client_app_secret}
&grant_type=client_credentials
```

If possible, it's recommended to use the supported [Microsoft Authentication Libraries (MSAL)](https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-acquire-token?tabs=dotnet#acquiretokenforclient-api) instead of protocol directly.

## Use a token

Now that you've acquired a token, use the token to make requests to the Lobyco endpoints. Lobyco endpoints expect to receive token in **Authorization** header:

`Authorization: Bearer {token}`

When the token expires, repeat the request to the /token endpoint to acquire a fresh access token.