Skip to content
Eventogy Developers

Authentication

Client credentials

  1. Eventogy issues you a client ID and client secret over a secure channel. The secret is shown once and cannot be retrieved later; store it in a server-side secret store and never in a browser or mobile app.
  2. Exchange them for an access token at POST /oauth/token (client-credentials grant).
  3. Send the token on every request as Authorization: Bearer <token>.

Tokens last one hour. There is no refresh token: cache the token in memory and request a new one when it expires or when a call returns 401.

Scopes. partners:read allows every GET endpoint. partners:write allows every POST, PUT, PATCH and DELETE endpoint. A token without the required scope gets 403. The token endpoint silently leaves out any scope your credential does not hold and does not tell you which scopes were granted — call GET /ping to see them.

Rotation and revocation. To rotate a secret, ask Eventogy for a new credential, switch to it, then ask for the old one to be revoked. Revocation is immediate and also invalidates tokens already issued.

What a credential can reach

A credential can read (and, with partners:write, change) data across your whole tenant. It is not limited to particular events or teams. Request only the scopes your integration needs.

Security

  • One credential, one tenant. A token only works against the tenant host it was issued for; used against another host it is rejected (401).
  • Isolated surface. Partner tokens can only reach /api/v1/partner; they cannot access any other Eventogy API, and neither Eventogy's own app tokens nor AI-assistant connections can access the Partner API.
  • Scope-enforced. Every endpoint requires the matching scope (partners:read / partners:write).
  • Short-lived tokens. Tokens expire after 1 hour, limiting the impact of a leaked token. There is no refresh token.
  • Instant revocation. A revoked credential (and all its live tokens) stops working immediately.
  • Keep the secret server-side. The client-credentials flow is for server-to-server use only — never embed your client secret in a browser or mobile app.