Choose authentication

Choose by caller identity

• User profiles and delegated user operations: Authorization Code + PKCE to obtain a user access token.
• Service calls: use client_credentials only when the endpoint supports service/org identity and the client has the matching grant and scopes.
• Secure backend scripts: use X-API-Key where supported, with matching identity/scopes. Never distribute keys to browsers, mobile clients or public repositories.
• Public anonymous calls: only when API Reference explicitly permits no credential.

GET /v1/users/me requires User identity and user:profile:read. Successful service token exchange does not grant user-profile access. Quickstart uses legitimate user OAuth authorization.

Create an application, then create an OAuth client separately under Credentials. Public clients use PKCE without secrets; Confidential client secrets stay on backends. See applications, user authorization and service authorization.