Send your credential's username and secret to the token endpoint. This exchange does not need a bearer token. Use the returned access token as a bearer token on subsequent REST requests.
password: This JSON field carries your API credential secret, not your account login password.
Make your first request
Run the example locally. It prompts for your credential, obtains an access token and lists the first page of devices. Keep the token private. These documentation pages never ask for or store credentials.
Choose a language and install the dependencies listed below. The examples use the Cloud API address. Never paste real secrets into documentation, support tickets or shared logs.
cURL: Bash + jq · Python: requests · C#: .NET 8+ (HttpClient)
C#: dotnet new console → Program.cs → dotnet run
$credential = Get-Credential
$body = @{
username = $credential.UserName
password = $credential.GetNetworkCredential().Password
audience = "api"
} | ConvertTo-Json
$token = Invoke-RestMethod -Method Post -Uri "https://api.remotegymp.com/v1/auth/token" -ContentType "application/json" -Body $body
$env:RG_API_TOKEN = $token.accessToken
Invoke-RestMethod -Uri "https://api.remotegymp.com/v1/devices?pageSize=25" -Headers @{ Authorization = "Bearer $env:RG_API_TOKEN" }Access token response
The credential exchange returns the fields below. The token shown here is a placeholder. The lifetime is in seconds and the expiry timestamp is UTC.
{
"accessToken": "<access-token>",
"tokenType": "Bearer",
"expiresIn": 1800,
"expiresAtUtc": "2026-10-26T12:30:00Z"
}Credential-issued tokens last 30 minutes. This exchange does not return a refresh token. When a token expires, exchange the credential again. For an interrupted write, check its outcome and the endpoint's retry rules before resubmitting it.
Choose where the access token can be used
audience: "api"- Use this value for REST API requests. It is the default when the audience field is omitted.
audience: "mcp"- Use this value only for an MCP client configured with a bearer token. The credential must have MCP enabled. API and MCP tokens cannot be used interchangeably.
If authentication fails
- 401
- Check the username and secret, credential expiry and revocation. On an authenticated request, also check token expiry and audience. Repeating the same invalid credential will not fix the problem.
- 403
- Check the response code and message. Access may be blocked by permissions, network or country policy, the Owner's current access, or add-on eligibility. A new token does not bypass those checks.
- 429 ·
Retry-After - Wait for the delay given in the response header before trying again. The default token-attempt limit is 10 per source IP per minute on each Relay. Platform settings can change this limit.