SKUTOPIA uses OAuth 2.0, a well-known standard. Every SKUTOPIA API call is authenticated with a short-lived JWT access token. You are issued a client_id and client_secret from the API Keys page of this portal; the secret is shown once, at creation, and cannot be retrieved later.
The credentials themselves are not an API key -- they are not sent to the API. Exchange them for an access token at the token endpoint using the OAuth 2.0 client credentials grant, then send that token as a bearer token on each request:
Code
The token endpoint accepts both client_secret_post (credentials in the form body) and client_secret_basic (credentials in the Authorization header). Each client is registered for exactly one of them -- see the token endpoint for which applies to your credentials.
Tokens expire (see expires_in on the token response). Cache the token in memory and reuse it until shortly before it expires, then mint a new one -- minting a token per request will get you rate limited. Treat the client_secret as a server-side secret: it must never reach a browser, a mobile app, or a source repository.
Client credentials token exchange flow
Exchanges your client_id and client_secret for a JWT access token. The request body is application/x-www-form-urlencoded -- not JSON.
Ory pins each client to exactly one client authentication method, fixed when the client is created. Presenting credentials the other way fails with 401 invalid_client, and the error_description names the method your client is registered for. Credentials issued from the API Keys page of this portal are registered for client_secret_post.
Switch between the two methods with the request example selector; the sample request updates to match.
client_secret_post--client_idandclient_secretare two more fields in the form body, and nothing goes in theAuthorizationheader.client_secret_basic-- the body carries onlygrant_type, and the pair travels in theAuthorizationheader instead, asBasic base64(client_id + ":" + client_secret). The sample request does not show this header: it is your credential, not something the gateway supplies. Both values must be form-urlencoded before they are base64-encoded (RFC 6749 2.3.1);curl -udoes not do that for you, so percent-encode any character outsideA-Z a-z 0-9 - . _ ~yourself first.
The returned access_token is a signed JWT. The gateway verifies it against the authorization server's JWKS, so tokens cannot be minted or modified anywhere else. You do not need to parse or validate it yourself -- send it back as Authorization: Bearer <access_token>. To find which authorization server issues tokens for this gateway, request /.well-known/oauth-protected-resource; its authorization_servers entry points at the issuer, whose /.well-known/openid-configuration carries the JWKS location.
Client credentials token exchange flow › Request Body
Decision Table
| Variant | Matching Criteria |
|---|---|
| type = object · requires: grant_type, client_id, client_secret | |
| type = object · requires: grant_type |
grant_typeAlways client_credentials.
client_idThe client id issued to you.
client_secretThe client secret issued to you.
scopeOptional, space-delimited. SKUTOPIA APIs do not currently require a scope -- leave this unset unless you have been told otherwise.
Client credentials token exchange flow › Responses
A new access token.
access_tokenThe JWT to send as Authorization: Bearer <access_token>.
token_typeAlways bearer.
expires_inSeconds until the token expires. Reuse the token until shortly before this elapses rather than minting one per request.
scopeThe scopes granted. Empty unless you requested one.