App access tokens are used to make requests to the Threads API on behalf of an app rather than a user. Certain APIs require app access tokens instead of user access tokens, such as the oEmbed API.
To generate an app access token, you need:
curl -X GET https://graph.threads.net/oauth/access_token ?client_id=<APP_ID> &client_secret=<APP_SECRET> &grant_type=client_credentials
{ "access_token": "TH|<APP_ID>|<ACCESS_TOKEN>", "token_type": "bearer" }
This call will return an app access token that can be used in place of a user access token to make API calls as noted above.
Note: Because this request uses your app secret, it must never be made in client-side code or in an app binary that could be decompiled. It is important that your app secret is never shared with anyone. Therefore, this API call should only be made using server-side code.
There is another method to make calls to the Threads API on behalf of an app which doesn't require using a generated app access token. You can just pass your app ID and app secret as the access_token
parameter when you make a call.
curl -X GET https://graph.threads.net/<API_ENDPOINT> ?access_tokens=TH|<APP_ID>|<APP_SECRET>&...
The choice to use a generated access token or this method depends on where you hide your app secret.