Skip to content

Authorization

Step 0 of every integration: obtain a Bearer credential. Machine-to-machine integrations exchange client credentials for an installation token, user-facing applications walk the Authorization Code + PKCE browser flow, and single-business scripts use a restricted key created in the cabinet. These endpoints live outside /api/v3 on the authorization server host.

Operations

Get authorization server metadata

Request

Machine-readable OAuth 2.0 authorization server metadata (RFC 8414): endpoint URLs, supported grant types, PKCE methods, and scopes. Agents and MCP hosts use this document to discover the authorization and token endpoints automatically.

curl -i -X GET \
  https://developer.alteg.io/_mock/en/b2b-v3/openapi/.well-known/oauth-authorization-server

Responses

Authorization server metadata.

Headers
X-Request-Idstring

Request identifier for support and log correlation.

Cache-Controlstring

Public metadata may be cached briefly; clients should revalidate before long-lived use.

Example:"public, max-age=3600"
Bodyapplication/json
issuerstringrequired
authorization_endpointstringrequired
token_endpointstringrequired
revocation_endpointstring
registration_endpointstring
response_types_supportedArray of strings
grant_types_supportedArray of strings
code_challenge_methods_supportedArray of strings
token_endpoint_auth_methods_supportedArray of strings
scopes_supportedArray of strings
Response
{
  "issuer": "https://api.alteg.io",
  "authorization_endpoint": "https://api.alteg.io/oauth/authorize",
  "token_endpoint": "https://api.alteg.io/oauth/token",
  "revocation_endpoint": "https://api.alteg.io/oauth/revoke",
  "registration_endpoint": "https://api.alteg.io/oauth/register",
  "response_types_supported": [
    "code"
  ],
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "refresh_token"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "none"
  ],
  "scopes_supported": [
    "locations:read",
    "locations:write",
    "locations:create",
    "services:read",
    "services:write",
    "products:read",
    "team_members:read",
    "team_members:write",
    "team_members:manage_access",
    "clients:read",
    "clients:read_contact",
    "clients:write",
    "availability:read",
    "appointments:read",
    "appointments:create",
    "appointments:write",
    "visits:read",
    "visits:write",
    "payments:read",
    "payments:capture",
    "payments:refund",
    "finance:read",
    "loyalty:read",
    "chain_services:read",
    "chain_services:write",
    "chain_clients:read",
    "chain_loyalty:read"
  ]
}