Skip to content

Authorization

Step 0 of every integration: obtain a Bearer credential. A person automating their own work creates an API key in the Developer Portal; agents, MCP hosts and applications acting for a user walk the Authorization Code + PKCE browser flow; marketplace applications will exchange client credentials for an installation token (planned, second delivery). The OAuth endpoints live outside /api/v3 on the authorization server host.

Operations

Get authorization server metadata

Request

Machine-readable OAuth 2.0 authorization server metadata (RFC 8414): endpoint URLs, supported grant types, PKCE methods, and scopes. Agents and MCP hosts use this document to discover the authorization and token endpoints automatically.

curl -i -X GET \
  https://developer.alteg.io/_mock/en/b2b-v3/openapi/.well-known/oauth-authorization-server

Responses

Authorization server metadata.

Headers
X-Request-Idstring

Request identifier for support and log correlation.

Cache-Controlstring

Public metadata may be cached briefly; clients should revalidate before long-lived use.

Example:"public, max-age=3600"
Bodyapplication/json
issuerstringrequired
authorization_endpointstringrequired
token_endpointstringrequired
revocation_endpointstring
registration_endpointstring
client_id_metadata_document_supportedboolean

Whether a client_id may be an HTTPS URL pointing to a client metadata document (CIMD). Clients that support the URL form only attempt it when this is true.

authorization_response_iss_parameter_supportedboolean

Every authorization response, success or error, carries iss equal to issuer (RFC 9207). Clients compare it with the recorded issuer before redeeming the code.

response_types_supportedArray of strings
grant_types_supportedArray of strings
code_challenge_methods_supportedArray of strings
token_endpoint_auth_methods_supportedArray of strings
scopes_supportedArray of strings
Response
{
  "issuer": "https://api.alteg.io",
  "authorization_endpoint": "https://api.alteg.io/oauth/authorize",
  "token_endpoint": "https://api.alteg.io/oauth/token",
  "revocation_endpoint": "https://api.alteg.io/oauth/revoke",
  "response_types_supported": [
    "code"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none"
  ],
  "authorization_response_iss_parameter_supported": true,
  "scopes_supported": [
    "analytics:read",
    "appointments:create",
    "appointments:read",
    "appointments:write",
    "audit:read",
    "availability:read",
    "checkout:cancel",
    "checkout:capture",
    "checkout:read",
    "checkout:refund",
    "client_accounts:read",
    "client_accounts:write",
    "clients:read",
    "clients:read_contact",
    "clients:write",
    "finance:read",
    "finance:write",
    "events:read",
    "events:write",
    "fiscalization:configure",
    "fiscalization:operate",
    "fiscalization:read",
    "inventory:operate",
    "inventory:read",
    "inventory:sell",
    "locations:read",
    "locations:write",
    "loyalty:issue",
    "loyalty:read",
    "loyalty:transact",
    "notifications:configure",
    "notifications:read",
    "notifications:send",
    "online_booking:configure",
    "online_booking:read",
    "payment_policies:apply",
    "payment_policies:configure",
    "payment_policies:read",
    "payroll:adjust",
    "payroll:configure",
    "payroll:pay",
    "payroll:read",
    "products:read",
    "products:write",
    "reviews:manage",
    "reviews:read",
    "services:read",
    "services:write",
    "team_members:read",
    "team_members:schedule",
    "team_members:write",
    "webhooks:manage",
    "chain_analytics:read",
    "chain_client_accounts:configure",
    "chain_client_accounts:read",
    "chain_clients:read",
    "chain_clients:read_contact",
    "chain_custom_fields:configure",
    "chain_loyalty:configure",
    "chain_loyalty:read",
    "chain_loyalty:transact",
    "chain_payroll:read",
    "chain_products:read",
    "chain_products:write",
    "chain_services:read",
    "chain_services:write",
    "chain_structure:manage",
    "chain_team_members:read",
    "chain_team_members:write"
  ]
}