---
title: Authentication
description: OAuth 2 client credentials and authorization code with PKCE.
sidebar:
  order: 22
---

Create an API application from **Settings → Integrations → API** (shown when partner API is enabled on the account). Studio generates a Doorkeeper application and shows the client id and secret once.

Redirect URI for out-of-band apps is `urn:ietf:wg:oauth:2.0:oob`. Scopes: `read write`.

## Client credentials

For servers and Zapier-style machines:

```
POST /oauth/token
grant_type=client_credentials
client_id=...
client_secret=...
scope=read write
```

The token is already bound to the account that owns the application. Do not send `X-Account-Id`.

## Authorization code + PKCE

For a human acting in Studio:

1. Send the user to `/oauth/authorize`
2. Exchange the code at `/oauth/token`
3. Call the API with `Authorization: Bearer …` **and** `X-Account-Id: <account id>`

`GET /api/v2/me` only works with these personal tokens. It returns the signed-in user.

## Using the token

```bash
curl https://studio.micepad.co/api/v2/account \
  -H "Authorization: Bearer ACCESS_TOKEN"
```

Write endpoints (create attendee, check in, field CRUD) require the `write` scope. Read endpoints accept `read`.

## CLI

The public [Micepad CLI](https://github.com/micepad/micepad-cli) talks to the same platform for events, attendees, check-in, and imports.