Skip to main content

Authentication

All placeholder APIs in this starter site assume OAuth 2.0 client_credentials.

Token flow​

  1. Request an access token from /oauth/token
  2. Include Authorization: Bearer <token> on each request
  3. Rotate credentials per your internal security policy
  • Store client_secret in a secrets manager
  • Rotate credentials regularly
  • Use separate credentials per environment
  • Avoid logging full tokens in application logs

Placeholder token response​

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read:chargebacks write:responses"
}

Next steps​

The final version of this section will include:

  • Supported grants and scope matrix
  • JWK verification guidance
  • Token introspection and revocation options