API authentication

This guide covers the server-to-server authentication scenario, most commonly used to connect other systems to Scalepoint APIs. Your backend authenticates with an application account using the OAuth 2.0 client credentials grant (RFC 6749 §4.4): it requests an access token from the Scalepoint token endpoint, then presents that token on every API call. No individual user identity is involved.

sequenceDiagram
    participant B as Your backend
    participant T as Scalepoint token endpoint
    participant A as Scalepoint API
    B->>T: POST /connect/token<br/>grant_type=client_credentials, scope,<br/>certificate assertion or client secret
    T-->>B: access_token, expires_in
    B->>A: API request<br/>Authorization: Bearer access_token
    A-->>B: response
    Note over B,A: Reuse the token until it expires, then request a new one

Choose a client credential

The token request must prove which client is asking. Scalepoint supports two methods:

Method	How it works	When to use it
Certificate assertion — recommended	Your client signs a short-lived JWT with a private key that never leaves your systems; Scalepoint verifies it against the public key registered for your account.	The default for API integrations. The Scalepoint helper libraries implement it for you.
Client secret	Your client posts a shared secret issued by Scalepoint.	For platforms that cannot sign JWTs - notably Microsoft Entra's SCIM provisioning service. Requires self-service secret management.

Token request

Request tokens from the token endpoint of the environment you are calling. The request is a form-encoded POST carrying grant_type=client_credentials, the scopes you need (space-separated), and your client credential — the exact shape is on each credential's page.

Scopes are per-API and listed on the API's own page — for example, case_integration for the Case Integration API or events for the Events API.

A successful response returns the access token and its lifetime in seconds:

{
  "access_token": "eyJ0eXAiOiJKV1...sjghxBcw",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Cache the token and reuse it until it expires — request a new one shortly before expires_in runs out, not once per call.

Calling an API

Send the access token in the Authorization header of every request (RFC 6750):

Authorization: Bearer <access_token>

Endpoints

Environment	Token endpoint
Sandbox	https://sandbox-accounts.scalepoint.com/connect/token
Production	https://accounts.scalepoint.com/connect/token

The sandbox endpoint serves every non-production environment.

Helper libraries

The Scalepoint helper libraries implement the certificate assertion flow, including assertion signing and token caching:

• .NET
• Java

Any standards-compliant OAuth 2.0 client library works as well.

Standards

• RFC 6749 — The OAuth 2.0 Authorization Framework (client credentials grant)
• RFC 7523 — JWT Profile for OAuth 2.0 Client Authentication
• OpenID Connect Core — Client Authentication (private_key_jwt)
• RFC 6750 — Bearer Token Usage