Authentication

The Secfix Public API uses the OAuth 2.0 client-credentials grant. Exchange your application’s client id and secret for a short-lived bearer access token, then send that token on every request.

Get a token

curl -X POST https://api.secfix.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Response

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 86400
}

The audience parameter is optional and defaults to the Secfix Public API; any other value is rejected.

Call the API

Send the access token as a bearer token:

curl https://api.secfix.com/v1/inventory/assets \
  -H "Authorization: Bearer eyJhbGciOi..."

Single active token

Each application has one active token at a time. Requesting a new token (or rotating the secret) immediately supersedes the previous token — the old token stops working and returns 401 token_superseded. Design your integration to fetch a token, reuse it until it expires, and re-fetch on 401.

Tenancy

Your workspace is bound to the token at issuance from the token’s customer_id claim. The API ignores any client-supplied tenant hints — you only ever see your own workspace’s data.

Get started

Core concepts

Guides

Get a token

Call the API

Single active token

Tenancy

​Get a token

​Call the API

​Single active token

​Tenancy

Get a token

Call the API

Single active token

Tenancy