Authentication

Integrations authenticate with a Service Account: a credential created inside your account, with its own permissions and expiration. It uses the OAuth 2.0 client_credentials flow and every request carries a Bearer token.

1. Create a Service Account

  1. In the CRM, open Settings › Service Accounts (administrators only) and click Novo service account.
  2. Give it a name, choose when it expires (90 days, 6 months, 1 year or never) and select the permissions it may use. Start with the minimum the integration needs.
  3. Copy the Client ID and the Client Secret. The secret is shown only once; if you lose it, generate a new one on the same screen.

2. Request a token

Request
curl -X POST https://magnetcustomer.net/realms/platform/protocol/openid-connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"
Response
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 900,
  "token_type": "Bearer"
}

The token lasts 15 minutes. Read expires_in (seconds) from the response and request a new token before it runs out — this flow has no refresh token.

3. Call the API

Each account has its own address. Replace your-account with your account subdomain — the same one you use to open the CRM.

Base URL
https://your-account.platform-api.magnetcustomer.com/api
cURL
curl "https://your-account.platform-api.magnetcustomer.com/api/contacts?page=1&limit=25" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Permissions

A Service Account can only do what its permissions allow, resource by resource. A request outside them returns 403. To change what an integration can do, edit the Service Account — there is no scope parameter to send in the token request.

Expiration and rotation

  • The CRM warns administrators when a credential is close to expiring. Renew it on the Service Accounts screen before the date.
  • Generating a new secret invalidates the previous one. Update your integration right after.
  • Use one Service Account per integration, so you can revoke one without stopping the others.
  • Keep the secret on the server side. Never ship it in a browser or mobile app.

Coming from OAuth Clients?

The old OAuth Clients screen was retired and its credentials are being shut down. Create a Service Account with the permissions your integration needs and swap the Client ID and Client Secret — the token endpoint and the API addresses stay the same.