Skutopia Public Gateway API

SKUTOPIA uses OAuth 2.0, a well-known standard. Every SKUTOPIA API call is authenticated with a short-lived JWT access token. You are issued a client_id and client_secret from the API Keys page of this portal; the secret is shown once, at creation, and cannot be retrieved later. The credentials themselves are not an API key -- they are not sent to the API. Exchange them for an access token at the token endpoint using the OAuth 2.0 client credentials grant, then send that token as a bearer token on each request:

Code
Authorization: Bearer <access_token>

The token endpoint accepts both client_secret_post (credentials in the form body) and client_secret_basic (credentials in the Authorization header). Each client is registered for exactly one of them -- see the token endpoint for which applies to your credentials. Tokens expire (see expires_in on the token response). Cache the token in memory and reuse it until shortly before it expires, then mint a new one -- minting a token per request will get you rate limited. Treat the client_secret as a server-side secret: it must never reach a browser, a mobile app, or a source repository.