Every authenticated call carries two credentials: your API key, and a bearer token you fetch first.This page gets you authenticated and nothing more — the two calls, the shape they return, and the two ways they fail. The endpoint itself, with every field and a live “Try it”, is Get access token.
Read the lifetime from data.expires_in rather than assuming it. It is set per account, so a number you hard-code from one environment can be wrong in another.