Minting
What is minting?
Minting is the process of creating and issuing a new API token that your application uses to authenticate requests. An authorization server mints the token after it verifies your credentials. Your application then sends the token with each API call until the token expires.
In OAuth 2.0, minting happens at the token endpoint. Your application presents its client credentials, and the authorization server returns a signed access token with a lifetime measured in seconds.
Minting vs. refreshing vs. caching
Minting creates a new token. Caching stores a token you already hold so you can reuse it. Refreshing means requesting a replacement before the current token expires. A well-built integration mints once, caches the token, and mints again only when the cached token nears expiration.
How minting works with OAuth 2.0
Bandwidth uses the OAuth 2.0 client credentials grant for machine-to-machine authentication. You create API credentials (a Client ID and a Client Secret) in the Bandwidth App, then follow these steps:
- Send a POST request to the token endpoint with
grant_type=client_credentials. - Authenticate the request with your Client ID and Client Secret, using
client_idandclient_secretbody parameters. - Read the
access_tokenandexpires_invalues in the response. - Send the token in the Authorization: Bearer header on each API request.
curl -X POST https://api.bandwidth.com/api/v1/oauth2/token \
-u "$BANDWIDTH_CLIENT_ID:$BANDWIDTH_CLIENT_SECRET" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials"The response includes an access_token (a JSON Web Token), an access_token_id, a token_type of Bearer, and expires_in, which currently returns 3600 seconds (one hour).
How Bandwidth is involved with minting
Bandwidth operates the authorization server that mints tokens for the Bandwidth APIs. The token endpoint at api.bandwidth.com issues each access token as a JSON Web Token, and Bandwidth publishes the signing keys and issuer metadata you need to validate tokens.
Newer versions of the Bandwidth SDKs handle minting for you. Pass your Client ID and Client Secret when you initialize the SDK, and it retrieves and refreshes tokens automatically. Supported versions include Node v7.1.0, Python v21.1.0, Java v16.1.0, C# v15.1.0, Ruby v17.1.0, and PHP v13.0.0 and later.
If you call the token endpoint directly, you manage the token lifecycle yourself.
What are the benefits of minting and caching tokens
Cache each token and reuse it until it expires. Bandwidth recommends this pattern for efficiency, and it gives you several advantages:
- Fewer requests. One mint serves every API call made during the token’s one-hour lifetime.
- Shared tokens. Multiple workers or services can use the same token without conflict.
- Safe overlap. Multiple valid tokens can exist at the same time for one Client ID, and Bandwidth sets no limit on concurrent valid tokens.
- Scoped access. The token carries the permissions assigned to your credentials, so each Client ID reaches only the APIs you allow.
Use the cached token until 5 to 10 seconds before it expires, then mint a new one with the same request. Mint tokens from a server in a secure environment. Never place a Client Secret in client-side code.
Minting FAQs
Minting means creating and issuing a new access token. The authorization server verifies your credentials and returns a signed token that your application sends with each API request.
A Bandwidth access token is valid for one hour (3600 seconds). The expires_in field in the token response shows the remaining lifetime in seconds.
No. Mint a token, cache it, and reuse it until shortly before it expires. Minting a token for every request adds latency and load without improving security.
Yes. Your application can request new tokens at any time, and multiple valid tokens for the same Client ID can coexist.
API requests that use an expired token fail authentication. Request a new token from the token endpoint with your current Client ID and Client Secret, then retry the request.
No. Bandwidth SDKs at the versions listed above mint, cache, and refresh tokens for you after you supply your Client ID and Client Secret.
Bandwidth is retiring username and password API Users on December 2, 2026. Migrate to OAuth 2.0 API credentials before that date.
Related
- Bandwidth API Authentication reference:
https://dev.bandwidth.com/apis/account-management-apis/authentication/ - Credential Management guide:
https://dev.bandwidth.com/docs/account/credentials/management/ - Help Center, Creating and managing your Bandwidth API credentials: https://www.bandwidth.com/support/en/articles/13004306-creating-and-managing-your-bandwidth-api-credentials
- RFC 6749, OAuth 2.0 Authorization Framework:
https://datatracker.ietf.org/doc/html/rfc6749
The information provided in this glossary definition does not, and is not intended to, constitute legal advice, nor does it necessarily represent Bandwidth’s products or business practices. This page is for general informational purposes only.
The information provided in this glossary definition does not, and is not intended to, constitute legal advice, nor does it necessarily represent Bandwidth's products or business practices. This page is for general informational purposes only.