---
title: Authentication and authorization
slug: cms-saas/api/authentication-and-authorization
docTags: 
createdAt: 2026-07-30T20:20:18.789Z
---

## Authentication

To use CMS (SaaS) REST API, you must authenticate calls with a bearer JSON Web Token (JWT) by requesting a JWT from the [token endpoint](https://docs.developers.optimizely.com/content-management-system/v1.0.0-CMS-SaaS/reference/oauth) with the [OAuth 2.0 protocol](https://www.rfc-editor.org/rfc/rfc6749) and then specify the token as a bearer in the `Authorization` header:

:::CodeblockTabs
HTTP

```http
  GET https://api.cms.optimizely.com/<version>/<endpoint>
  Authorization: Bearer <your_access_token>
  
```
:::

## Request a token

You need a **Client ID** and **Secret** to request a token. If you do not have these credentials, create an API key using the following instructions.

### Create API key

1. Go to **Settings > API Keys** in your CMS (SaaS) instance.
2. Click **Create API Key**.

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/ytjhtz0igSlTKMYON6-q9_cms-create-api-key.png" size="100" isUploading="false" position="center" width="908" height="609" darkWidth="908" darkHeight="609" showCaption="false" indent="1"}

3. Enter a **Name** and click **Create API Key**. The **Name** can only contain letters, numbers, hyphens, and underscores.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/NEku9NYLYOukWMTbLoiIQ-20260730-202020.png)

4. The **Client ID** and **Secret** are auto-filled. Save these values.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/49MjnpXvespuKoXRjJXpe-20260730-202020.png)

:::Paragraph{indent="1"}
You can restrict what operations the API key can execute. See the [Authorization](#) section.
:::

### Request token

After creating an API key, you can request a token for the API client using `application/json` or `application/x-www-form-urlencoded` using basic authentication. The token is valid for 300 seconds (five minutes). Request a new token when this token expires.

**JSON**

:::CodeblockTabs
request

```http
  POST https://api.cms.optimizely.com/oauth/token
  Content-Type: application/json

  {
    "grant_type": "client_credentials",
    "client_id": "CLIEND_ID",
    "client_secret": "CLIENT_SECRET"
  }
  
```
:::

Replace `CLIENT_ID` and `CLIENT_SECRET` with the values you saved from creating the API key.

**X-www-form-urlencoded**

:::CodeblockTabs
request

```http
  POST https://api.cms.optimizely.com/oauth/token
  Content-Type: application/x-www-form-urlencoded
  Authorization: Basic Base64(GetBytes(client_id:client_secret))

  grant_type=client_credentials
  
```
:::

**Response**

When you provide correct credentials, a JWT is returned in the `access_token` property:

```json
{
  "access_token": "[REDACTED]",
  "expires_in": 300,
  "token_type": "Bearer"
}
```

Copy the `access_token` to use with your API calls. The token is valid for 300 seconds (five minutes). Request a new token when this token expires.

## Authorization

When [managing content](docId\:p9XgSvFtr8nSot5JGYOq0), the API key's content permissions are evaluated.

Find API key content permissions on the **Set Access Rights** page. Go to **Settings > Set Access Rights**, as shown in the following image:

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/oE8Jnxdvh6ywntflF4VKf-20260730-202020.png)

The REST API requires a `scope` claim with the `api:admin` scope to access. This scope is included by default in the access token returned when you authenticate through a `POST` request to `https://api.cms.optimizely.com/oauth/token`.

The access token contains claims that identify the requester and provide additional information. The `api:admin` scope claim was recently added. This change is not breaking and requires no updates to existing partner implementations or code.