Overview

Cliquify protects REST resources under /api/* with OAuth 2.0 using the client credentials flow.

When to use this flow

Use client credentials when:

your integration runs on a server, backend, worker, or ETL job

there is no per-request end-user login in the browser

you can keep the client secret in a secure location such as environment variables or a secret manager

Do not use this flow from browser-only apps, mobile apps, or any public client that cannot safely store a secret.

Authentication flow

Create an OAuth client in the developer portal

Exchange client_id and client_secret for an access token

Send the token in the Authorization header for every protected request

Optionally introspect or revoke the token

Required scopes for resource routes

Protected resource routes require all of the following scopes:

profile:read

templates:read

assets:read

The documented token helper endpoints request the full scope set automatically.

Important note

Cliquify does not expose GET /api/user for this integration path. If you need token metadata such as client_id, user_id, scopes, or expires_at, use token introspection instead.

When to use this flow#

Authentication flow#

Required scopes for resource routes#

Important note#

When to use this flow

Authentication flow

Required scopes for resource routes

Important note