Authentication

Your agency authenticates with the OAuth 2.0 client-credentials flow. Stafflion issues a client ID and a client secret for each environment.

Exchange them for an access token at the token endpoint. Send the token on every request as Authorization: Bearer <access_token>.

Token lifetime

The token expires after 24 hours. Cache it until it expires instead of requesting a new one for every call. When a call returns 401, request a new token and send the call again.

Do not log the client secret or the token.