Authentication

The Server API uses the OAuth2 client credentials grant. Your backend authenticates with a client_id / client_secret pair, receives a short-lived access token, and sends that token as Authorization: Bearer <token> on every request.

We mint and verify the token

Unlike the Web SDK, there is no JWKS to publish — we issue the token and verify it ourselves. All you hold is the credential pair.

Getting credentials

Credentials are issued by the Noughty Reality team, one pair per client. You receive:

Value	Shape	Notes
client_id	pk_srv_…	Public identifier. Safe to log.
client_secret	sk_srv_…	Shown once. Store it in a secrets manager.

The secret is shown once

We store only a hash of your secret, so we cannot recover it. If you lose it, we issue a new pair and revoke the old one.

Requesting a token

POST /auth/server/token with a JSON body:

curl -X POST https://api.noughtyreality.com/tours/v1/auth/server/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "pk_srv_…",
    "client_secret": "sk_srv_…"
  }'

Response:

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
  "token_type": "Bearer",
  "expires_in": 900
}

Field	Description
access_token	The bearer token to send on each request.
token_type	Always Bearer.
expires_in	Lifetime in seconds (15 minutes).

Using the token

Send it as a bearer token on every request:

curl https://api.noughtyreality.com/tours/v1/server/tours \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…"

Cache the token

Tokens live for 15 minutes. Cache one and reuse it until it nears expiry rather than requesting a fresh token per call.

Errors

Errors return a JSON body of the form { "statusCode", "code", "message" }.

Status	message	When
400	Bad request	The request body is missing a field, or grant_type is not client_credentials.
401	invalid_client	The client_id / client_secret pair is wrong, or the credential is disabled.
401	Unauthorized	The access token is missing, malformed, expired, or its credential has since been revoked.

Revocation is immediate

Disabling a credential takes effect at once — no new tokens can be minted, and existing tokens stop working on their next request, because we re-check the credential on every call.