# Authorization

## OAuth 2.0 Client Credentials Flow 
Balad™ APIs implement the OAuth 2.0 Client Credentials flow, which is designed for server-to-server authentication. This flow allows your application to request an access token directly using your Client ID and Client Secret without user interaction.

:::check[]
All API calls must include an Authorization header in this format: 
**Authorization:** Bearer `<ACCESS_TOKEN>`  
:::
## What You will Need Before You Start

<Steps>
  <Step title="Step 1 — Get Onboarded">
    Contact the **Balad® Support Team** to complete the onboarding process and receive your credentials.
  </Step>
  <Step title="Step 2 — Get Your Base URL">
    The **Base URL** for your APIs will be provided during onboarding.
  </Step>
  <Step title="Step 3 — Obtain Your API Keys">
    After onboarding, you will need to generate client credentials from Dashboard
  </Step>
    </Steps>
   
    
## Generate Client Credentials from Dashboard

<Steps>

<Step title="Step 1 — Log in to Balad Dashboard">
Go to the **Balad® Dashboard** and sign in using your provided credentials.
</Step>

<Step title="Step 2 — Navigate to Client Secrets">
From the left-hand menu, go to **Developer → Client Secrets** to manage your client secrets.
    
![Dashboard API Credentials](https://api.apidog.com/api/v1/projects/1056134/resources/360732/image-preview)
</Step>

<Step title="Step 3 — Add Client Secret">
Click **Add Client Secret**, provide a **Description** and set the **Expiration Date**, then click **Confirm**.

![Client Secret Screenshot](https://api.apidog.com/api/v1/projects/1056134/resources/360733/image-preview)

</Step>

<Step title="Step 4 — Copy and Store Your Client Secret">
Once generated, **copy the client secret immediately** and store it in a secure location, as it will not be visible again for security reasons.

![Copy Secret.jpg](https://api.apidog.com/api/v1/projects/1056134/resources/360734/image-preview)
    
You will use the **Client ID** and **Client Secret** when requesting an **Access Token** for your API requests. [Token](https://developers.balad.tech/token-20919907e0.md)
</Step>

</Steps>


# 🌟 Benefits of OAuth with Balad

<CardGroup cols={3}>
  <Card title="🔐 Secure Access">
    Every API request is authorized using access tokens, keeping transactions safe.
  </Card>
  <Card title="⚡ Fine-Grained Scopes">
    Tokens are scoped to specific APIs (remittances, collections, bills, vouchers).
  </Card>
  <Card title="⛓️ Revocable Tokens">
    Access can be revoked instantly from the Balad dashboard if compromised.
  </Card>
</CardGroup>