Authentication

Your agency authenticates with the OAuth 2.0 client-credentials flow. Stafflion issues a client ID and a client secret for each environment. Exchange them for an access token, then send the token on every request.

Token request

Call the token endpoint with your client ID, client secret, the audience of the environment, and grant_type set to client_credentials.

Using the token

Send the token in the Authorization header of every request:

Authorization: Bearer <access_token>

The token expires after expires_in seconds (86400, 24 hours). Request a new token when it expires. Do not log the client secret or the token.

Headers

Header	Value	Used in
Content-Type	application/json	Token request, events
Authorization	Bearer <access_token>	Events, synchronized shifts API
Accept	application/json	Synchronized shifts API

Request and responses

curl

curl --request POST \
  --url https://auth.stafflion.com/oauth/token \
  --header 'Content-Type: application/json' \
  --data '{
  "audience": "https://staging.stafflion.com/api/v1",
  "client_id": "YOUR_STAGING_CLIENT_ID",
  "grant_type": "client_credentials",
  "client_secret": "YOUR_STAGING_CLIENT_SECRET"
}'

PHP

<?php

$payload = json_encode([
    'audience' => 'https://staging.stafflion.com/api/v1',
    'client_id' => 'YOUR_STAGING_CLIENT_ID',
    'grant_type' => 'client_credentials',
    'client_secret' => 'YOUR_STAGING_CLIENT_SECRET',
]);

$ch = curl_init('https://auth.stafflion.com/oauth/token');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

JavaScript

const response = await fetch('https://auth.stafflion.com/oauth/token', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    "audience": "https://staging.stafflion.com/api/v1",
    "client_id": "YOUR_STAGING_CLIENT_ID",
    "grant_type": "client_credentials",
    "client_secret": "YOUR_STAGING_CLIENT_SECRET"
  }),
});

const data = await response.json();
console.log(data);

Python

import requests

response = requests.post(
    'https://auth.stafflion.com/oauth/token',
    json={
    'audience': 'https://staging.stafflion.com/api/v1',
    'client_id': 'YOUR_STAGING_CLIENT_ID',
    'grant_type': 'client_credentials',
    'client_secret': 'YOUR_STAGING_CLIENT_SECRET',
},
    timeout=30,
)

print(response.json())

Responses

200 OK

OK

Access token

{
  "expires_in": 86400,
  "token_type": "Bearer",
  "access_token": "ACCESS_TOKEN"
}

401 Invalid client ID or secret

Invalid client ID or secret. Illustrative body, confirm against staging.

Invalid client

{
  "error": "invalid_client",
  "error_description": "Invalid client credentials."
}

422 Validation failed

Validation failed. A required field is missing.

Missing client_id

{
  "message": "The given data was invalid.",
  "errors": {
    "client_id": [
      "The client_id field is required."
    ]
  }
}