Skip to main content

Authenticate with the Partner API

The Partner API uses the OAuth 2.0 client credentials grant. Before you begin, get your Client ID and Client secret.

Request an access token​

Authenticate with HTTP Basic authentication and send a form-encoded request to the token endpoint:

curl --request POST "https://api.workstaff.app/oauth/token/" \
  --user "$CLIENT_ID:$CLIENT_SECRET" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=staff:read"

The response contains the access token, its lifetime in seconds, its type, and the granted scopes:

{
  "access_token": "your-access-token",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "staff:read"
}

Request a new access token after the current token expires.

Choose scopes​

Request only the scopes your integration needs:

  • staff:read lists and retrieves staff profiles.
  • staff:write creates and updates staff profiles.

Make your first request​

Send the access token as a Bearer token in the Authorization header:

curl "https://api.workstaff.app/partner/v1/staff/" \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --header "Accept: application/json"

Each access token belongs to one Workstaff account. It can access only the staff profiles associated with that account.