OAuth 2.0 API credentials
The Quivo API now supports OAuth 2.0 with the client credentials grant. Your integration authenticates with an API credential instead of a Connector user account.What’s new- Self-service: Account Admins create API credentials in The Connector under Admin › API Credentials. No approval from Quivo is needed.
- No user passwords in integrations: An integration uses a client ID and a client secret, not a Connector username and password. It does not need an
X-Api-Keyheader. - Independent of people: Staff changes, new passwords and multi-factor authentication (MFA) on Connector users no longer affect your integration.
- One credential per integration: Each integration gets its own credential, so you can rotate or revoke it on its own.
- Rotation without downtime: After you rotate a credential, the old one keeps working for up to 7 days while you update your integration.
- Expiry reminders: Credentials are valid for one year. The Connector reminds you 90, 30, 7 and 1 days before a credential expires.
- Standard OAuth 2.0: Request an access token from
POST ${BASE_URL}/v2/oauth2/tokenwith any HTTP client. Then call${BASE_URL}/v2/...withAuthorization: Bearer <YOUR_ACCESS_TOKEN>.
POST /login is deprecated. It keeps working until 31 January 2027. From 1 February 2027, the API accepts integrations only with an API credential, and integrations that still use POST /login can no longer access the API.Switch your integrations before then. Both methods work side by side until that date, so you can switch one integration at a time without downtime. Follow the steps in Migrate to OAuth 2.0 API credentials.Get started