Authentication
The WebinOne API uses bearer tokens. Every request must include a valid JWT in the Authorization header. Tokens are scoped to a single site, so a token issued for one site cannot read or change another.
The Authorization header
Send the token as a bearer credential on every request:
Authorization: Bearer <your-token>Getting a token
Request a token from the OAuth token endpoint using the client credentials grant. Send the parameters as application/x-www-form-urlencoded. Use the client_id and client_secret issued for your site in the Agency Portal, and the public_api scope.
curl -X POST "https://your-site.webinone.com/api/v1/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "client_id=<client-id>" \ -d "client_secret=<client-secret>" \ -d "scope=public_api"
const res = await fetch("https://your-site.webinone.com/api/v1/oauth/token", {
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({
grant_type: "client_credentials",
client_id: "<client-id>",
client_secret: "<client-secret>",
scope: "public_api"
})
});
const { access_token } = await res.json();import requests
res = requests.post(
"https://your-site.webinone.com/api/v1/oauth/token",
data={
"grant_type": "client_credentials",
"client_id": "<client-id>",
"client_secret": "<client-secret>",
"scope": "public_api",
},
)
access_token = res.json()["access_token"]$client = new GuzzleHttp\Client();
$response = $client->post('https://your-site.webinone.com/api/v1/oauth/token', [
'form_params' => [
'grant_type' => 'client_credentials',
'client_id' => '<client-id>',
'client_secret' => '<client-secret>',
'scope' => 'public_api',
],
]);
$token = json_decode($response->getBody())->access_token;using var client = new HttpClient();
var form = new FormUrlEncodedContent(new[] {
new KeyValuePair<string,string>("grant_type", "client_credentials"),
new KeyValuePair<string,string>("client_id", "<client-id>"),
new KeyValuePair<string,string>("client_secret", "<client-secret>"),
new KeyValuePair<string,string>("scope", "public_api"),
});
var response = await client.PostAsync(
"https://your-site.webinone.com/api/v1/oauth/token", form);The response contains the token in access_token — send that value as the bearer token on subsequent requests.
{ "access_token": "eyJhbGciOi...", "token_type": "Bearer" }
Keep client secrets and tokens server-side. Never expose them in browser code or public repositories. Credentials are issued per site in the Agency Portal.
Scope
A token authorizes calls for the site it was issued for. To work across several client sites, obtain a separate token per site — this is what keeps agency workspaces isolated in the white-label model.