Authentication

Turning a client id and secret into a one-hour access token.

This is the only unauthenticated endpoint in the API, and the only one that reads your client secret. Cache the token you get back and re-request it when it expires or when a call answers 401.

If the account restricts access by IP (Settings → Security & login), that restriction is enforced here as well — a call from an address that is not on the list is refused before any token is issued.

📄️Get an access token

Exchange a client id and secret for a bearer token that lasts one hour.

📄️Inspect the current token

What this token can do: which account it belongs to and exactly which scopes it