Authentication API

POST/Account/RequestToken

Request access tokens for the Hubli APIs. The Authentication API is the entry point for every other API call: you exchange a clientId and clientSecret for a short-lived JWT, then send that JWT in the Authorization header of subsequent requests.

For a step-by-step guide to authentication, see the Authentication guide.

Never expose client secrets

Do not commit clientSecret values to source control, expose them in browser-side code, or log them. Rotate credentials immediately if a secret is leaked.

Exchange client credentials for a JWT access token.

Request body

Parameters

clientIdstringRequired

The client identifier issued to your integration.

clientSecretstringRequired

The confidential client secret.

scopesstringOptional

Space-separated OAuth scopes. Omit to use the default scopes associated with the client.

Response

A successful request returns 200 OK with a JSON object containing the access token.

Response fields

accessTokenstring

The JWT to include in the Authorization header of subsequent API calls.

expiresIninteger

Token lifetime in seconds.

tokenTypestring

Always Bearer.

Errors

Status	Meaning
`400 Bad Request`	The request body failed model validation. Check the `ValidationFailure` array in the response.
`401 Unauthorized`	The `clientId` or `clientSecret` is invalid, or the client is disabled.
`422 Unprocessable Content`	The request was understood but could not be processed.

Example request

curl -X POST https://dashboard.alpha.meetingsbooker.com/authenticationapi/Account/RequestToken \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "your_client_id",
    "clientSecret": "your_client_secret",
    "scopes": "event.read enquiries.read"
  }'

var client = new HttpClient();
var response = await client.PostAsJsonAsync(
    "https://dashboard.alpha.meetingsbooker.com/authenticationapi/Account/RequestToken",
    new
    {
        clientId = "your_client_id",
        clientSecret = "your_client_secret",
        scopes = "event.read enquiries.read"
    });

var token = await response.Content.ReadFromJsonAsync<TokenResponse>();

const response = await fetch('https://dashboard.alpha.meetingsbooker.com/authenticationapi/Account/RequestToken', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    clientId: 'your_client_id',
    clientSecret: 'your_client_secret',
    scopes: 'event.read enquiries.read'
  })
});

const { accessToken } = await response.json();

Example response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "expiresIn": 3600,
  "tokenType": "Bearer"
}

Using access tokens

After receiving a token, send it on every request to protected endpoints. The docs site stores the token in your browser's session storage for the duration of the tab. Use the Try it out panel above to fetch a token, then switch to another API page and the token is included automatically.

CORS and the Try it out panels

The docs site runs in your browser and calls the API directly. If the API's CORS policy blocks the request, the panel shows a cURL command instead. Copy that command into your terminal to run the same request. You can also use the code examples on each endpoint page.

GET /v1/BudgetReport/GetBudgetsReport
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

When the token expires, the API returns 401 Unauthorized. Re-request a token from POST /Account/RequestToken and retry the original call.

Token caching

Cache tokens until near expiry. The Hubli APIs rate-limit token requests, so avoid fetching a new token for every API call.