generated: '2026-07-20'
method: searched
source: https://docs.ottimate.com/auth.md
docs: https://docs.ottimate.com/auth
summary:
  types:
  - oauth2
  - apiKey
  notes: >-
    Every request to the Ottimate API requires BOTH an `X-API-Key` header and an
    `Authorization: Bearer <access_token>` header. The access token is obtained
    via the OAuth2 client-credentials flow; the API key is provisioned per client
    account by an Ottimate Partner Manager.
schemes:
- name: OAuth2
  type: oauth2
  flow: clientCredentials
  scheme: bearer
  token_url_production: https://api.ottimate.com/v1/oauth/token
  token_url_sandbox: https://sandbox-auth.ottimate.com/oauth/token
  grant_type: client_credentials
  parameters:
  - client_id
  - client_secret
  - grant_type
  - scope
  scopes:
  - accounts.can_access_dashboard
  token_lifetime_seconds_example: 31536000
  description: >-
    Server-to-server OAuth2 client-credentials flow. Client ID and Client Secret
    are provisioned by an Ottimate Partner Manager. Tokens should be cached and
    refreshed on expiry or on a 401 response.
- name: ApiKey
  type: apiKey
  in: header
  header_name: X-API-Key
  description: >-
    Per-client-account API key, required on every request in addition to the
    Bearer token. Provisioned by an Ottimate Partner Manager. Rotating the API
    key invalidates all cached idempotency entries scoped to the old key.
access_control:
  model: OAuth app -> API User -> scoped data access
  scope_levels:
  - account-level    # all companies and locations in the account
  - company-level    # single company and all its locations
  - location-level   # specific location(s) only
  docs: https://docs.ottimate.com/account-structure/scoping