Tokens are passed using an authentication header and are used to authenticate a user account with the API.
You can either obtain a single user specific token or follow the OAuth flow described below.
In the majority of cases, we advise to use a single user token for authentication.
Please note that API access is available on selected plans only. If you are new to DISCO, email us at [email protected].
Single user bearer token
Best used if you are building an integration between your platform and a DISCO that you have access to.
- Get in touch with your DISCO Customer Success Manager.
- Specify which of your admin users you want to obtain a token for. We don't have service account tokens. If you don't want the token to be associated to a specific user, you may want to create a generic admin user in your DISCO instead. Ask our team for advise if you are unsure.
- We will share the token with you securely.
OAuth flow
Best used if you are building an integration for a third party that needs to log into their own DISCO to do something with your integration.
- Get in touch with your DISCO Customer Success Manager.
- Tell us your preferred redirect URL. We will give your client ID and client secret in return.
- Establish the OAuth flow. It should begin here: https://your-business-hostname.disco.ac/oauth/authorize/?client_id=YOUR_CLIENT_ID&response_type=code
- User logs in to DISCO.
- Once a user has landed on the https://your-business-hostname.disco.ac/oauth/authorize/ page, they will be asked to confirm authorization for external application’s access to their DISCO. They will be redirected to the redirect URL provided to us in step 2.
- Send a POST request to https://your-business-hostname.disco.ac/oauth/token/ with following parameters:
| Parameter | Description |
|---|---|
| grant_type | authorization_code |
| code | returned in step 5 |
| client_id | provided in step 2 |
| client_secret | provided in step 2 |
| redirect_uri | defined in step 2 |
https://{HOSTNAME}.disco.ac/oauth/token/?code={CODE}&grant_type=authorization_code&client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}&redirect_uri={REDIRECT}- Client application receives access token.
- Requests to external API can now be sent with the Bearer token in the authorization header, as detailed in the rest of this guide.