Authentication overview

Version: 1.0 Last updated: 2026-10-07

Legacy endpoint

This guide covers authenticating against the XCIS API using the new OAuth2 authorization server. If you are currently using the legacy authentication endpoint, see Migrating from the legacy endpoint. The legacy endpoint will be decommissioned on 31 January 2027.

XCIS uses the OAuth 2.0 Client Credentials grant for API authentication. This is a standard machine-to-machine flow:

1. You exchange your client credentials for an access token.
2. You include that token as a Bearer token on every API request.
3. You cache and reuse the token until it is close to expiry, then request a new one.

No user login, browser redirect, or consent screen is involved.

Endpoints

The token endpoint and API base for staging and production are listed under Environments.

In this guide

• Requesting tokens: the token request, the required audience parameter, and calling the API
• Scopes
• Token caching (required)
• Errors
• Migrating from the legacy endpoint