> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.stafflion.com/api/api-reference/authentication/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.stafflion.com/_mcp/server.

# Authentication

Your agency authenticates with the OAuth 2.0 client-credentials flow. Stafflion issues a client ID and a client secret for each environment.

Exchange them for an access token at the token endpoint. Send the token on every request as `Authorization: Bearer <access_token>`.

## Token lifetime

The token expires after 24 hours. Cache it until it expires instead of requesting a new one for every call. When a call returns 401, request a new token and send the call again.

Do not log the client secret or the token.


## API Docs

- Authentication [Access Token](https://developers.stafflion.com/api/api-reference/authentication/access-token.md)

## OpenAPI Specification

The raw OpenAPI 3.1 specification for this API is available at:
- [OpenAPI JSON](https://developers.stafflion.com/openapi.json)
- [OpenAPI YAML](https://developers.stafflion.com/openapi.yaml)