Authentication

Authenticate with a Bearer API key for most workloads or OAuth 2.0 Client Credentials for delegated access.

API Keys

Every request must include your key in the Authorization header.

import eosyn, os
client = eosyn.Client(api_key=os.environ["EOSYN_API_KEY"])

OAuth 2.0 (Client Credentials)

Use OAuth for machine-to-machine workflows that require scoped, short-lived tokens.

# Client Credentials flow
import requests
resp = requests.post("https://auth.eosynspace.com/oauth/token", data={
  "grant_type": "client_credentials",
  "client_id": CLIENT_ID,
  "client_secret": CLIENT_SECRET,
  "scope": "risk:read changes:read",
})
access_token = resp.json()["access_token"]

Token Refresh

Access tokens expire after 60 minutes. Exchange your refresh token to obtain a new one without prompting a user.

curl -X POST https://auth.eosynspace.com/oauth/token \
  -d grant_type=refresh_token \
  -d refresh_token=$REFRESH_TOKEN \
  -d client_id=$CLIENT_ID

Security Best Practices

Store keys in a secrets manager, never in source control.
Rotate keys every 90 days and immediately on suspected compromise.
Scope keys to the minimum permissions required for the workload.
Use separate keys per environment (sandbox, staging, production).
Enforce HTTPS on every request; plain HTTP is rejected.
Log key identifiers, never the key value.

OAuth 2.0 (Client Credentials)

Use OAuth for machine-to-machine workflows that require scoped, short-lived tokens.

# Client Credentials flow
import requests
resp = requests.post("https://auth.eosynspace.com/oauth/token", data={
  "grant_type": "client_credentials",
  "client_id": CLIENT_ID,
  "client_secret": CLIENT_SECRET,
  "scope": "risk:read changes:read",
})
access_token = resp.json()["access_token"]

Security Best Practices

Store keys in a secrets manager, never in source control.
Rotate keys every 90 days and immediately on suspected compromise.
Scope keys to the minimum permissions required for the workload.
Use separate keys per environment (sandbox, staging, production).
Enforce HTTPS on every request; plain HTTP is rejected.
Log key identifiers, never the key value.