API Quick Start

⚠️ Common Mistake: If you’re using Postman and see “Password Credentials” as a grant type option, do not select it. This causes an error. Use one of the two methods below instead.

Which Method Should I Use?

All three methods give you the same result: an access token you can use to make API calls. Pick the one that fits your situation.

Method A: Browser Login (Authorization Code Flow)

This is the easiest way to get a token when you’re sitting at your computer testing things out.

What You Need

• Your Client ID and Client Secret (contact ScopeStack support if you don’t have these)
• A ScopeStack user account you can log into

Steps

1. In Postman, go to the Authorization tab of your request or collection
2. Set Auth Type to OAuth 2.0
3. Configure these settings:
   • Grant Type: Authorization Code
   • Callback URL: Provided by the application
   • Auth URL: https://app.scopestack.io/oauth/authorize
   • Access Token URL: https://app.scopestack.io/oauth/token
   • Client ID: Your client ID
   • Client Secret: Your client secret
   • Scope: read write
4. Click Get New Access Token
5. A browser window opens—log into ScopeStack (including SSO/MFA if your account requires it)
6. After login, Postman receives the token automatically
7. Click Use Token

That’s it. Your requests will now include the access token in the Authorization header.

Method B: Client Credentials (Recommended for Automation)

Use this method when connecting a server, automation platform, or AI assistant to ScopeStack. No browser, no passwords needed.

What You Need

• A service account with client credentials. See the Service Account Credentials guide for setup.

Steps

1. Create a new POST request
2. Set the URL to: https://app.scopestack.io/oauth/token
3. Go to the Authorization tab and set it to No Auth
4. Go to the Body tab
5. Select x-www-form-urlencoded
6. Add these key-value pairs and click Send

You’ll get a JSON response with your access_token. No refresh token is needed. When the token expires, make this same request again to get a new one.

Method C: Password Grant

This method is supported for existing integrations. For new integrations, use Method B (Client Credentials) instead.

What You Need

• Your account-level Client ID and Client Secret (contact ScopeStack support if you don’t have these)
• A service account username and password (see the Building Integrations guide for setup)

Steps

1. Create a new POST request
2. Set the URL to: https://app.scopestack.io/oauth/token
3. Go to the Authorization tab and set it to No Auth
4. Go to the Body tab
5. Select x-www-form-urlencoded
6. Add these key-value pairs and click Send

You’ll get a JSON response with your access_token and refresh_token. Copy the access_token to use in your API requests.

Verify It Worked

Make a test call to confirm your token is working and you’re connected to the right account:

1. Create a GET request to: https://api.scopestack.io/v1/me
2. Add these headers:
   • **Authorization: **Bearer \{your_access_token\}
   • **Accept: **application/vnd.api+json
3. Click Send

You should see a 200 OK response with your user information, including the account-slug and account-id you’ll need for other API calls.

Something Went Wrong?

For more detailed troubleshooting, see the Troubleshooting API Authentication guide.