# Calling the API with an access token

> With an access token from the OAuth flow, you call the same API a platform calls with its API key, with two differences.

With an access token from [the OAuth flow](/platforms/account-sharing/connect/), you call the same API a platform calls with its API key, with two differences.

**Send the token as a Bearer token:**

```
Authorization: Bearer at_1234_h480djs93hd8
```

**Leave the instance out of the URL.** The token already says which account it is for, so requests go to `https://app.shuttleglobal.com/c/api/...` rather than `/c/api/instances/{instance_key}/...`:

```bash
curl "https://app.shuttleglobal.com/c/api/transactions?limit=1" \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

Each operation in the API reference shows this form: choose **OAuth** in the request panel's credentials.

Keep each merchant's tokens separate, and never use one merchant's token for another. When a token expires you get a `401`: [refresh it](/platforms/account-sharing/connect/#4-refresh-the-access-token) and retry.