OAuth client credentials

The client credentials grant exchanges a credential ID (the client ID) and its token (the client secret) for an access token that lasts at most 15 minutes and works at one interface only.

Request a token

Authenticate with HTTP Basic. Form-encode the ID and secret before joining them with :.

curl -s https://api.inside.chat/oauth/token \
  -u "$INSIDE_CLIENT_ID:$INSIDE_CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d "scope=website_read conversation_read" \
  --data-urlencode "resource=https://api.inside.chat/mcp"

{
  "access_token": "igw_live_...",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "website_read conversation_read"
}

Field	Notes
`scope`	Optional. A space-separated subset of the credential’s scopes. Omit it to receive all of them.
`resource`	Selects where the token works. See the table below.

Choose the resource

A token works only at the resource it was issued for:

`resource` value	Token works at
`https://api.inside.chat`, or omitted	REST `/api/v1/...`
`https://api.inside.chat/mcp`	Business MCP `/mcp`
`https://api.inside.chat/a2a`	Business A2A `/a2a`

Limits

Tokens last at most 900 seconds and never outlive the credential.
No refresh token is issued. Request a new token before the current one expires.
At most 100 active access tokens can exist per credential. Above that, the token endpoint returns 429 with Retry-After: 60.

Revoke a token

curl -s https://api.inside.chat/oauth/revoke \
  -u "$INSIDE_CLIENT_ID:$INSIDE_CLIENT_SECRET" \
  -d "token=$ACCESS_TOKEN"

Revocation returns 200 whether or not the token exists, so the response never reveals which tokens are valid.