Authentication

OAuth 2 client credentials and authorization code with PKCE.

Create an API application from Settings → Integrations → API (shown when partner API is enabled on the account). Studio generates a Doorkeeper application and shows the client id and secret once.

Redirect URI for out-of-band apps is urn:ietf:wg:oauth:2.0:oob. Scopes: read write.

Client credentials

For servers and Zapier-style machines:

POST /oauth/token
grant_type=client_credentials
client_id=...
client_secret=...
scope=read write

The token is already bound to the account that owns the application. Do not send X-Account-Id.

Authorization code + PKCE

For a human acting in Studio:

Send the user to /oauth/authorize
Exchange the code at /oauth/token
Call the API with Authorization: Bearer … and X-Account-Id: <account id>

GET /api/v2/me only works with these personal tokens. It returns the signed-in user.

Using the token

curl https://studio.micepad.co/api/v2/account \
  -H "Authorization: Bearer ACCESS_TOKEN"

Write endpoints (create attendee, check in, field CRUD) require the write scope. Read endpoints accept read.

CLI

The public Micepad CLI talks to the same platform for events, attendees, check-in, and imports.