Skip to content
Help Center
Products

API Reference

Authentication

The KC api uses the industry-standard OAuth 2.0 protocol for authorization. Specifically, it uses Bearer Tokens passed in the Authorization header for authenticated requests.

Authentication flow

To interact with protected endpoints, your application must first obtain an access token. The primary method supported is the Authorization Code Grant, suitable for web applications, but the Client Credentials Grant may also be viable for server-to-server integrations.

  1. Authorization request (Authorization Code Grant) — redirect the user to the /integration/v1/oauth2/authorize endpoint. The user authenticates with KnowledgeCity and grants your application permission. KnowledgeCity redirects back to your specified redirect_uri with an authorization code.
  2. Token exchange — your application exchanges the authorization code (or its client credentials for the Client Credentials Grant) for an access token by making a POST request to the /integration/v1/oauth2/token endpoint. Provide your client_id, client_secret, and the appropriate grant_type (authorization_code or client_credentials).
  3. API calls — use the obtained access_token from the previous step to make requests to the desired API endpoints. Include the token in the Authorization header as a Bearer token.
  4. Token refresh — access tokens have a limited lifetime. Use the provided refresh_token with the refresh endpoint to obtain a new access token without requiring the user to re-authenticate.

Making authenticated requests

Include the access token in the Authorization header for all API requests requiring authentication:

Authorization: Bearer YOUR_ACCESS_TOKEN

Replace YOUR_ACCESS_TOKEN with the actual access token string.

Further details

For specific parameter details for each OAuth 2.0 step, please consult the individual endpoints in the OAuth 2.0 API Reference section.