oauth

Obtain an access token (OAuth 2.0 client_credentials)

Exchanges integrator credentials for a 24-hour access token to use as a Bearer token on subsequent API calls. This endpoint is unauthenticated at the gateway layer — your client_secret in the request body is the authentication. Ritten forwards the credentials to Auth0, validates the response, and caches the resulting token server-side so repeated calls do not consume your Auth0 mint quota.

The response shape mirrors the OAuth 2.0 / Auth0 /oauth/token response so existing OAuth2 client libraries work without modification.

Mint quota interaction: the per-app token mint quota (2/hour, 3/day) counts mints actually performed against Auth0. Because this endpoint caches server-side, repeated calls within a 24-hour window typically result in zero additional Auth0 mints — so calling here is far cheaper against your quota than calling Auth0 directly. See the Authentication and Rate Limiting sections above.

post/oauth/token

Request

  • Base URL: https://api.ritten.io/v1
  • URL: https://api.ritten.io/v1/oauth/token
  • Auth: none required

Request body

grant_type'client_credentials' required

OAuth 2.0 grant type. Must be client_credentials.

client_idstring required

Your Auth0 M2M client ID.

client_secretstring password required

Your Auth0 M2M client secret.

audiencestring required

The audience for the requested token. Must equal the env-specific external-api audience (e.g. https://external-api.ritten.io in production, https://external-api.beta.ritten.io in beta).

Example request

{
  "grant_type": "client_credentials",
  "audience": "https://external-api.ritten.io"
}

Response

Access token issued.

access_tokenstring required

The access token to use as a Bearer token on subsequent API calls.

token_typestring required
expires_ininteger required

Token lifetime in seconds (currently 86400 / 24h).

scopestring

Space-separated list of granted scopes (may be empty).

Example response

{
  "token_type": "Bearer",
  "expires_in": 86400
}

Changes

No recorded changes to this operation across all 1 revision of this API.