Authentication
The Clerky Partner API will use OAuth 2.0 bearer tokens. OAuth-based access is coming soon; client registration, URLs, scopes, token lifetime, and refresh behavior will be published before partner integrations launch.
Authorization flow
The Partner API will use the authorization code flow:
- Redirect the user to Clerky.
- The user signs in and authorizes access.
- Clerky redirects back with an authorization code.
- Your server exchanges the code for an access token.
- Your server sends the token with Partner API requests.
Access model
Each token is limited by the authorizing user, authorized Clerky teams, and granted OAuth scopes. A token can only access resources allowed by all three.
Keep the code exchange and token storage on your server. Do not expose client secrets or tokens in browser or mobile code.
API requests
Send the access token as a bearer token. Include Accept on every request.
Authorization: Bearer ACCESS_TOKEN
Accept: application/vnd.api+json
For requests with a JSON body, also include Content-Type.
Content-Type: application/vnd.api+json