Authentication - Secfix Developers

The Secfix Public API uses the OAuth 2.0 client-credentials grant. Exchange your API key’s client id and secret for a short-lived bearer access token, then send that token on every request.

Get a token

curl -X POST https://api.secfix.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Response

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 86400
}

Call the API

Send the access token as a bearer token:

curl https://api.secfix.com/v1/inventory/assets \
  -H "Authorization: Bearer eyJhbGciOi..."

Single active token

Each API key has one active token at a time. Requesting a new token (or rotating the secret) immediately supersedes the previous token — the old token stops working and returns 401 token_superseded. Design your integration to fetch a token, reuse it until it expires, and re-fetch on 401.

Tenancy

Your workspace is bound to the token at issuance from the token’s customer_id claim. The API ignores any client-supplied tenant hints — you only ever see your own workspace’s data.