Request a token (Client Credentials)

POST 
/oauth/token

OAuth 2.1 token endpoint. Use client_credentials grant with your client_id and client_secret.

Include company_id to get a Company Token (access a specific company's data). Omit company_id to get a Connector Token (manage your own connections).

Request

Responses

Responses

200

Access token issued successfully.

400

invalid_grant — requested company-level scopes without company_id on a connector client. Or invalid_scope — requested a scope not in the client's allowed list.

401

invalid_client — wrong client_id or client_secret, inactive client, wrong environment, or no active connection for the given company_id.

---

Token types

Company Token (with company_id)

Access a specific company's data — orders, menu, invoices, clients, etc.

Requires an active connection between your connector and the company. If the connection is pending, rejected, or revoked, the request fails with invalid_client.

The JWT includes company_id, company_currency, company_timezone, and company_country claims.

Company-level scopes: → See Scopes for the full list.

Connector Token (without company_id)

Manage your own connections — list, activate, reject. No company data access.

All requested scopes must be connector-level. Requesting a company-level scope without company_id fails with invalid_grant.

Connector-level scopes: → See Scopes for the full list.

Client authentication

You can send credentials in two ways:

Request body:

POST /oauth/token
  grant_type=client_credentials
  client_id=YOUR_CLIENT_ID
  client_secret=YOUR_CLIENT_SECRET

HTTP Basic:

POST /oauth/token
Authorization: Basic base64(CLIENT_ID:CLIENT_SECRET)
  grant_type=client_credentials