Client secret

Client secret authentication is for clients that cannot sign a JWT — most notably Microsoft Entra's SCIM provisioning service, which supports only this method. For API integrations, prefer the certificate assertion.

Scalepoint generates the secret and issues it to you during onboarding. Secrets are stored hashed and cannot be shown again later, so put the value in your secrets manager when you receive it.

Token request

POST to the token endpoint, form-encoded:

POST /connect/token HTTP/1.1
Host: sandbox-accounts.scalepoint.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=scim%3Aread%20scim%3Awrite

The response and token usage are the same as for any credential — see Token request.

Rotation

Several secrets can be active for the same client, so rotation happens without downtime: get a new secret from Scalepoint, switch your client to it, then have the old one removed.

If the secret is used for Entra provisioning, update it in your enterprise application's provisioning configuration — see Provisioning from Entra ID.