Authentication

OAuth2 Client Credentials flow for machine-to-machine authentication.

Token Format: JWT (JSON Web Token) Issuer: https://connect.firsty.app Audience: firsty-api

How to obtain credentials:

1. Contact Firsty support to receive your client_id and client_secret
2. Securely store your credentials (use environment variables, secrets manager)

Token Lifetime: 24 hours (86400 seconds)

Token Handling:

• Treat tokens as opaque strings - do not attempt to parse or validate them
• Include the token in the Authorization: Bearer {token} header for all API requests
• Tokens are validated server-side only
• Cache tokens and refresh before expiration to minimize auth requests

Security Best Practices:

• Keep credentials confidential (use environment variables or secrets manager)
• Use HTTPS for all requests (TLS 1.2+ required in production)
• Never expose credentials in client-side code or public repositories
• Implement proper token storage (secure credential storage, never localStorage for web apps)
• Rotate client secrets regularly through the Admin API