Authenticates an integration with client credentials and returns an access token. Use the location's client_id and client_secret from the Kivly panel, not OAuth credentials issued by Shopify, MCP or another provider. Send JSON from your backend. No grant_type, IP registration or separate integration activation is required by this endpoint. The account and location must be active. Read data.token and send it as Authorization: Bearer . Tokens expire after 3600 seconds; request a new token with the same credentials. There is no refresh token. Rotating either credential revokes existing Public API tokens. Credentials from the normal panel use production; staging credentials require separate provisioning. A 403 with generic Access denied may come from an upstream access rule: report UTC time, path and X-Request-ID/CF-Ray to Kivly support without sending the secret.