Authentication
Every request is authenticated with a short-lived bearer token from the OAuth 2.0 client-credentials grant.
Every request is authenticated with a short-lived bearer token, generated from your API access credentials using the OAuth 2.0 client-credentials grant. Your access ID and secret are provisioned automatically in the Flow dashboard — keep them server-side, never in browser code.
1. Exchange credentials for an access token
curl -X POST "https://dev.flow.staging.linktoany.com/api/1.0/standalone-link-engine-service/oauth/server/access-token" \
-H "accept: application/json" \
-H "content-type: application/x-www-form-urlencoded" \
--data client_id=YOUR_ACCESS_ID \
--data client_secret=YOUR_ACCESS_SECRET \
--data grant_type=client_credentials{
"access_token": "eyJhbGciOiJIUzI1NiIs...",
"token_type": "Bearer",
"expires_in": 3600
}2. Call unified endpoints with the token
curl "https://dev.flow.staging.linktoany.com/api/1.0/standalone-link-engine-service/unified/{accountId}/customer?mappingKey={readKey}&pageSize=50" \
-H "accept: application/json" \
-H "authorization: Bearer <access_token>"Token lifetime
Tokens expire after 3600 seconds. Cache the token and refresh before expiry rather than requesting one per call. Rotate your access secret from the dashboard at any time — old tokens are invalidated once rotation completes.