Accessing the End Customer Core APIs requires a Core API Key, or an OAuth2 access token, that must be passed in the Headers section of the request as the following header:
| Header Name | Value |
|---|---|
| Authorization | Core API Key |
| Authorization | Bearer <OAuth2 access token> |
Core API Keys provide Full Administrative Level access to all data in the tenant!
OAuth2 access tokens
Third-party applications that integrate with Xyte can use OAuth2 access tokens as an alternative to Core API Keys. An organization administrator approves the application once, choosing at the same time who may sign in through it — anyone with access to the organization, the members of one group, or administrators only; after that those users can sign in to it, and the application calls the same endpoints with Authorization: Bearer xoat_... instead of an API key. No key has to be created or shared.
Every OAuth2 access token has the same reach as a Core API Key — full administrative access to the organization — no matter whether an administrator or an ordinary member signed in to obtain it. The signed-in user's own access in the portal does not narrow it. Request the openid scope and the application also receives an id_token identifying that user.
OAuth2 & OpenID Connect explains the flow, token lifetimes, how to disconnect an application, and the endpoint reference for developers.