diff --git a/src/entrypoint.ts b/src/entrypoint.ts
index c2146d8..7c158a7 100644
--- a/src/entrypoint.ts
+++ b/src/entrypoint.ts
@@ -2,6 +2,8 @@ import logger from './logger'
 import os from 'os'
 import express from 'express'
 import { AHCServer } from './server'
+import { HejtoProvider } from './lib/hejto/services/hejto-provider'
+import config from './lib/hejto/config'
 
 (async () => {
 	const entrypoint = await AHCServer({ app: express() })
@@ -15,6 +17,12 @@ import { AHCServer } from './server'
 		);
 	}
 
+    // get token from hejto auth
+    const { hejtoAuthData, hejtoAuthUrl } = config
+    const token = await HejtoProvider.getToken(hejtoAuthUrl, hejtoAuthData)
+    // set token to env
+    process.env.HEJTO_API_KEY = token.access_token
+
 	entrypoint.listen(port, () => {
 		logger.info(`🛡️  Server started on port: ${port}`)
 		logger.info(`🖥️  Running in env: ${process.env.NODE_ENV}`)
diff --git a/src/lib/hejto/config/index.ts b/src/lib/hejto/config/index.ts
index 0c9305a..9ff7d6c 100644
--- a/src/lib/hejto/config/index.ts
+++ b/src/lib/hejto/config/index.ts
@@ -6,7 +6,13 @@ export default {
 	environment: process.env.NODE_ENV,
 	port: process.env.PORT,
 	hejtoApiUrl: 'https://api.hejto.pl',
-	headers: {
+    hejtoAuthUrl: 'https://auth.hejto.pl/token',
+    hejtoAuthData: {
+        client_id: process.env.HEJTO_CLIENT_ID,
+        client_secret: process.env.HEJTO_CLIENT_SECRET,
+        greant_type: process.env.HEJTO_GRANT_TYPE
+    },
+    headers: {
 		Authorization: `Bearer ${process.env.HEJTO_API_KEY}`
 	}
 }
diff --git a/src/lib/hejto/services/hejto-provider.ts b/src/lib/hejto/services/hejto-provider.ts
index 35c6007..bd3846a 100644
--- a/src/lib/hejto/services/hejto-provider.ts
+++ b/src/lib/hejto/services/hejto-provider.ts
@@ -5,9 +5,21 @@ import { HejtoResponse } from '../types/hejto-response.type'
 import { IHejtoProvider } from '../interfaces/hejto-provider.interface'
 import config from '../config'
 
+type HejtoTokenResponse = {
+    access_token: string;
+    expires_in: number;
+}
+
+type HejtoTokenConfig = {
+    client_id: string;
+    client_secret: string;
+    greant_type: string;
+}
+
 export class HejtoProvider extends IHejtoProvider {
 	private BASE_URL: string
 	private HEADERS: { [key: string]: any }
+    private static token: HejtoTokenResponse | null = null
 
 	constructor() {
 		super()
@@ -38,6 +50,11 @@ export class HejtoProvider extends IHejtoProvider {
 				data: response.data, status: response.status, headers: response.headers
 			}
 		} catch (e) {
+            // 493 means token is probably expired, so get new token and set env to new token
+            if (e.response?.status === 403) {
+                const token = await this.refreshToken()
+                process.env.HEJTO_API_KEY = token.access_token
+            }
 			const responseMsg = e.response?.data ?? e.response?.message
 
 			logger.error('Request to Hejto API failed:', {
@@ -51,7 +68,40 @@ export class HejtoProvider extends IHejtoProvider {
 		}
 	}
 
+    static async getToken(
+        authUrl: string,
+        tokenRequest: HejtoTokenConfig,
+        headers?: { [key: string]: any }
+    ): Promise<HejtoTokenResponse> {
+        if (!HejtoProvider.token) {
+            const axiosInstance = axios.create({
+                headers: { ...headers },
+            })
+
+            const response = await axiosInstance.request<HejtoTokenResponse>({
+                url: authUrl,
+                method: 'POST',
+                data: {
+                    ...tokenRequest,
+                },
+            })
+
+            const { access_token, expires_in } = response.data;
+            HejtoProvider.token = {
+                access_token,
+                expires_in,
+            }
+        }
+
+        return HejtoProvider.token
+    }
+
 	private format(url: string): string {
 		return concatUrls(this.BASE_URL, url)
 	}
+
+    private refreshToken() {
+        const { hejtoAuthData, hejtoAuthUrl } = config
+        return HejtoProvider.getToken(hejtoAuthUrl, hejtoAuthData)
+    }
 }