# OAuth for generating Management API tokens **URL:** \ **Category:** Get Help\ **Tags:** tokens, api, oauth, refresh-tokens, management-api\ **Created:** [May 15, 2017, 5:38pm UTC](https://community.auth0.com/t/oauth-for-generating-management-api-tokens/6617 "2017-05-15T17:38:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![claudio.petrini](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/claudio.petrini/32/7167_2.png) [@claudio.petrini](https://community.auth0.com/u/claudio.petrini)\ **Post date:** [May 15, 2017, 5:38pm UTC](https://community.auth0.com/t/oauth-for-generating-management-api-tokens/6617/1 "2017-05-15T17:38:44Z")
From the [Management API documentation](https://auth0.com/docs/api/management/v2/tokens#1-create-and-authorize-a-client) it seems that user would need to share the manually generated `token` or their `client_id` and `client_secret` in order to generate a token. Is there a way to interact with the Management API using OAuth so that at the end of the OAuth flow the output is an `access_token` and a `refresh_token` that will be later used to request a Management API token? ---
**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\ **Post date:** [May 15, 2017, 11:05pm UTC](https://community.auth0.com/t/oauth-for-generating-management-api-tokens/6617/2 "2017-05-15T23:05:35Z")
The recommended approach to obtain tokens for the Management API is to make use of OAuth2 client credentials flow like it’s mentioned in the documentation you linked to. A refresh token for client credentials grant is a bit redundant because a refresh token is meant to represent a specific grant that was issued and which can be reused to obtain refreshed access tokens at a later time. This is equivalent to the client identifier and client secret because that information when used within the scope of client credentials grant is already sufficient to represent the grant in question and can also be used to obtain _refreshed_ access tokens. In conclusion, the answer to your question is no. If you want to give access to the Management API to a given application then that application will need to know a client identifier and a client secret and perform a client credentials grant. ---
**Author:** ![claudio.petrini](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/claudio.petrini/32/7167_2.png) [@claudio.petrini](https://community.auth0.com/u/claudio.petrini)\ **Post date:** [May 16, 2017, 1:18pm UTC](https://community.auth0.com/t/oauth-for-generating-management-api-tokens/6617/3 "2017-05-16T13:18:05Z")
Thank you for the answer @jmangelo, I’ll make sure to use the `client_id` and `client_secret` in order to obtain tokens. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:53am UTC](https://community.auth0.com/t/oauth-for-generating-management-api-tokens/6617/4 "2018-03-02T05:53:55Z")