Authentication

The OLIFY API uses the OAuth 2.0 client credentials grant for application authentication. OLIFY issues a client ID and client secret for a Directory service account. Credentials are not self-service; request them from OLIFY.

Treat the client secret as sensitive. Store it in a secrets manager or equivalent protected configuration, never in source code or client-side applications.

Request an access token

Send a form-encoded POST request to the Directory token endpoint:

POST https://api.olify.io/directory/connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id={client_id}&client_secret={client_secret}&scope=olifyapi

The request must include all four form fields:

curl -sS -X POST 'https://api.olify.io/directory/connect/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode "client_id=$OLIFY_CLIENT_ID" \
  --data-urlencode "client_secret=$OLIFY_CLIENT_SECRET" \
  --data-urlencode 'scope=olifyapi'

Token response

A successful request returns a Bearer access token:

{
  "access_token": "eyJ…",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "olifyapi"
}

expires_in is the token lifetime in seconds. The client credentials grant does not return a refresh token. Cache the access token securely and request a new one before it expires.

An incorrect client ID or client secret returns HTTP 400 from the token endpoint. Token endpoint failures use an OAuth error response, not the OLIFY API error body documented in Errors.

Call the OLIFY API

Send the access token in the Authorization header on every subsequent OLIFY API request:

GET https://api.olify.io/assets?$top=10
Authorization: Bearer {access_token}
Olify-Tenant-Id: {tenant_id}
Accept: application/json

curl -sS 'https://api.olify.io/assets?$top=10' \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Olify-Tenant-Id: $TENANT_ID" \
  -H 'Accept: application/json'

Do not place access tokens in URLs or query parameters. Use the standard Bearer header:

Authorization: Bearer {access_token}

A missing, expired, or invalid Bearer token returns HTTP 401. The response is produced by the authentication middleware and does not use the OLIFY API { "error", "data", "traceId" } error format.

The service account determines which operations and tenants your application can access. Continue with Your first request, then review Tenancy.