API Reference/Authentication

Authentication

Obtain and use an OAuth 2.0 access token.

The API uses OAuth 2.0. Exchange your client credentials for an access token, then send it as a Bearer credential on protected routes. The token determines which organization's data you can access, so use credentials issued for that organization only.

1. Get a token#

Use grant_type: client_credentials with your client ID and secret:

curl -X POST https://api.chatasist.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

The response contains an access_token and its lifetime. Client-credentials access tokens last 12 hours (expires_in is in seconds):

{
  "token_type": "Bearer",
  "expires_in": 43200,
  "access_token": "eyJ0eXAiOiJKV1Qi..."
}

grant_type: refresh_token is available when your integration already holds a valid refresh token. Otherwise, request a new access token with client_credentials again.

2. Call the API#

Send the token as a Bearer credential:

curl https://api.chatasist.com/api/v1/customers \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Accept: application/json"

Getting credentials#

OAuth clients are managed in the web app under Settings → API integration (Administrator role required). See API tooling for the full set of credential types — OAuth clients, company API keys, and personal access tokens.

Pagination

How list endpoints page through results. Endpoints are listed in the sidebar.