Overview
What a Flavours integration is, how a system authenticates with client credentials, and what an access token can call today.
An integration is a machine credential that lets a third-party system — an ERP, an accounting package, a middleware service, a script — authenticate against one Flavours market without a person signing in. Odoo is one example; any system that can send an HTTPS request and store a secret can connect.
Integrations use the OAuth 2.0 client credentials grant. There is no user login, no redirect, and no refresh token.
How it works
- A market owner or manager creates an integration in the Flavours web app. Flavours returns a client ID and a client secret. The secret is shown exactly once.
- Your system sends the client ID and client secret to the token endpoint,
POST /oauth/token. - Flavours returns an access token that is valid for one hour
(
expires_in: 3600). - Your system caches the token and requests a new one shortly before it expires. See Token lifecycle.
One integration belongs to exactly one market. Create one integration for each system you connect, so you can rotate or revoke each one independently.
What a token can call today
No business endpoint accepts an integration access token yet. Today you can
create an integration, edit its scopes, rotate its
secret, revoke it, and obtain a token from POST /oauth/token. A token request
that succeeds proves your credentials are valid; the token cannot yet be used
to read or change market data.
Each endpoint that starts accepting integration tokens is announced in the Changelog and gets its own page in this section in the same release. Until then, do not build calls against endpoints that this section does not document.
Two different credentials
An integration access token is not the credential described on the Authentication page. That page covers the credential for the endpoints in the API reference. An integration token is obtained from the token endpoint with a client ID and secret, and is accepted only by endpoints that say so on their own page.
Glossary
| Term | Meaning |
|---|---|
| Integration | A named credential for one external system, bound to one market. |
| Client ID | The public identifier of the integration. A UUID. Not secret. |
| Client secret | The private key of the integration. Shown once, when the integration is created or its secret is rotated. Flavours stores only a hash and cannot show it again. |
| Access token | A short-lived Bearer token returned by POST /oauth/token. Valid for one hour. |
| Scope | A permission, such as menu.read, stored with the integration. See Scopes. |
| Rotation | Replacing the client secret. The old secret and every access token issued from it stop working immediately. |
| Revocation | Permanently disabling the integration and every token issued from it. |