Marco Ramos asked a question.

January 28, 2026 at 5:55 PM
Generating an access token for a custom backend service

We've got an internal process where users generate a PDF manually and then upload the file to ShareFile to share with external contacts. I'm exploring the level of effort to automate this process in our backend. I've generated a Client Id and Secret. I will not be using a redirect URI since there is no frontend application planned for this automation and there will be no ShareFile user logging in.

 

Reviewing this documentation, https://api.sharefile.com/gettingstarted/oauth2, I only see documentation for the authorization_code and refresh_token grant types.

 

Is it possible to generate an access token without user login/authorization?

 

I tried the following and got an error:

 

POST /oauth/token HTTP/1.1

User-Agent: PostmanRuntime/7.51.0

Accept: */*

Postman-Token: 15bfe4fa-4dcc-4bed-8400-cb5bbe308059

Host: secure.sharefile.com

Accept-Encoding: gzip, deflate, br

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 135

 

grant_type=client_credentials&client_id=FPQuXBzyL6PQPSBogjR5lREevd6gnLAV&client_secret=<REDACTED>

 

HTTP/1.1 400 Bad Request

Date: Wed, 28 Jan 2026 17:54:15 GMT

Content-Type: application/json;charset=UTF-8

Content-Length: 31

Connection: keep-alive

Set-Cookie: AWSALBTG=GCfmxGMSgw9kmvGRUM1NPvjHHXEr98UmmN7JQgbKetcXn2MFvDlYDZPGuvx+22ewN+PLx1XYziNGWOry1Ze0bbdNSk8dEMvvyi5gPB2HUptv84uaueLdabA3gb+ZOvziU6DWcjJ2YXKucKnQHh3ybmj0M8bvn6JENplsnxWq9+nR; Expires=Wed, 04 Feb 2026 17:54:15 GMT; Path=/

Set-Cookie: AWSALBTGCORS=GCfmxGMSgw9kmvGRUM1NPvjHHXEr98UmmN7JQgbKetcXn2MFvDlYDZPGuvx+22ewN+PLx1XYziNGWOry1Ze0bbdNSk8dEMvvyi5gPB2HUptv84uaueLdabA3gb+ZOvziU6DWcjJ2YXKucKnQHh3ybmj0M8bvn6JENplsnxWq9+nR; Expires=Wed, 04 Feb 2026 17:54:15 GMT; Path=/; SameSite=None; Secure

Set-Cookie: AWSALB=ph1j0iyba7iNV8J+xKsgpoxQrJv+xhLsAoD7gFaW5peOINTwM7cocSLGEn8WvdDOOLs3KEKu3lvC9l6NgT+lsShuf+PgwPpAgY/LZLsoMQ/9x62YpQqIuzwIdDcE; Expires=Wed, 04 Feb 2026 17:54:15 GMT; Path=/

Set-Cookie: AWSALBCORS=ph1j0iyba7iNV8J+xKsgpoxQrJv+xhLsAoD7gFaW5peOINTwM7cocSLGEn8WvdDOOLs3KEKu3lvC9l6NgT+lsShuf+PgwPpAgY/LZLsoMQ/9x62YpQqIuzwIdDcE; Expires=Wed, 04 Feb 2026 17:54:15 GMT; Path=/; SameSite=None; Secure

Cache-Control: no-store, no-cache

Expires: Tue, 27 Jan 2026 17:54:15 GMT

Citrix-TransactionId: e2498d0b-f8e2-43e2-acd0-ec7d3e056ad3

CorrelationId: 2tCMBNxRx0OLOy2CSQDcFA

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

X-Frame-Options: DENY

X-Robots-Tag: noindex

X-SFAPI-RequestID: MOtZrftkFU6u-l_2J6sX-Q

 

{"error":"unauthorized_client"}

 

 

  • 2 answers
  • 185 views

  • Kevin Glenn

    Hi Macro,

     

    I see you're using Client Credentials as the grant type in the example you shared. Unfortunately we do not support that method for third party applications. Instead, we recommend authorization_code grant or password (resource owner) grant.

     

    And if your primary concern with those methods is hardcoding a password, I would recommend generating an Application Specific Password which once used will be tied that exact application and won't function with anything else.

     

    Below you'll find some sample code for authenticating to ShareFile through PowerShell via HTTPS requests (not using the ShareFile PowerShell SDK)

     

     

    # --- Configuration ---

    $Subdomain   = "YOUR_SUBDOMAIN"         # e.g., "mycompany" for https://mycompany.sharefile.com

    $ClientId   = "YOUR_CLIENT_ID"

    $ClientSecret = "YOUR_CLIENT_SECRET"

    $Username   = "EMAIL@ADDRESS.COM"

    $Password   = "APP_SPECIFIC_PASSWORD"

     

    # --- Compose request ---

    $Url = "https://$Subdomain.sharefile.com/oauth/token"

    $Body = @{

      grant_type  = 'password'

      client_id   = $ClientId

      client_secret = $ClientSecret

      username   = $Username

      password   = $Password

    }

    $Headers = @{ 'Content-Type' = 'application/x-www-form-urlencoded' }

     

    # --- Send request ---

    try {

      $Response = Invoke-RestMethod -Method Post -Uri $Url -Headers $Headers -Body $Body

    }

    catch {

      throw "Authentication request failed. $($_.Exception.Message)"

    }

     

    # --- Extract tokens ---

    $AccessToken = $Response.access_token

    $RefreshToken = $Response.refresh_token

    Selected as Best

  • Kevin Glenn

    Hi Macro,

     

    I see you're using Client Credentials as the grant type in the example you shared. Unfortunately we do not support that method for third party applications. Instead, we recommend authorization_code grant or password (resource owner) grant.

     

    And if your primary concern with those methods is hardcoding a password, I would recommend generating an Application Specific Password which once used will be tied that exact application and won't function with anything else.

     

    Below you'll find some sample code for authenticating to ShareFile through PowerShell via HTTPS requests (not using the ShareFile PowerShell SDK)

     

     

    # --- Configuration ---

    $Subdomain   = "YOUR_SUBDOMAIN"         # e.g., "mycompany" for https://mycompany.sharefile.com

    $ClientId   = "YOUR_CLIENT_ID"

    $ClientSecret = "YOUR_CLIENT_SECRET"

    $Username   = "EMAIL@ADDRESS.COM"

    $Password   = "APP_SPECIFIC_PASSWORD"

     

    # --- Compose request ---

    $Url = "https://$Subdomain.sharefile.com/oauth/token"

    $Body = @{

      grant_type  = 'password'

      client_id   = $ClientId

      client_secret = $ClientSecret

      username   = $Username

      password   = $Password

    }

    $Headers = @{ 'Content-Type' = 'application/x-www-form-urlencoded' }

     

    # --- Send request ---

    try {

      $Response = Invoke-RestMethod -Method Post -Uri $Url -Headers $Headers -Body $Body

    }

    catch {

      throw "Authentication request failed. $($_.Exception.Message)"

    }

     

    # --- Extract tokens ---

    $AccessToken = $Response.access_token

    $RefreshToken = $Response.refresh_token

    Selected as Best