Authentication & scopes

Each API client belongs to one company and holds a set of scopes. The company comes from the credential, never from the request body.

API Key

X-Api-Key: sgk_live_xxxxxxxx
# or
Authorization: Bearer sgk_live_xxxxxxxx

OAuth2 Client Credentials

curl -X POST https://api.crmgateway.brainstorming-solutions.com//oauth/token \
  -u "cli_xxxx:sgs_live_xxxx" \
  -d grant_type=client_credentials \
  -d scope="posts:write comments:read"

{ "access_token": "eyJ...", "token_type": "Bearer", "expires_in": 3600, "scope": "posts:write comments:read" }

Scopes

`accounts:read`	Read accounts
`posts:read`	Read posts
`posts:write`	Publish and cancel
`comments:read`	Read comments
`comments:write`	Reply, hide and delete
`operations:read`	Read operations
`uploads:write`	Upload files
`sandbox:write`	Sandbox tools

Rotating keys

After rotation the old key keeps working for a configurable grace period (api.key_rotation_grace_hours), so you can switch without downtime.

Rate limits

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Over the limit: 429 with Retry-After.