Authentication

MeetingsBooker APIs use JWT Bearer tokens. Tokens are obtained via the Authentication API using client credentials.

Client credentials flow

1. Your application requests a token by sending clientId and clientSecret to POST /RequestToken.
2. The Authentication API validates the credentials and returns a signed JWT.
3. Your application includes the JWT in the Authorization: Bearer {token} header on subsequent requests.

Token endpoint

POST /RequestToken
Content-Type: application/json

{
  "clientId": "string",
  "clientSecret": "string",
  "scopes": []
}

Scopes

The current client-credentials implementation returns a token with the claims associated with the client. The scopes array is accepted for future extensibility.

Secured endpoints

Most Reporting API endpoints require an Authorize policy. For example, BudgetReportController requires the ViewBudgets policy. If your token does not satisfy the policy, the API returns 401 Unauthorized or 403 Forbidden.

See the Authentication API reference for full endpoint details.