Skip to main content

Authentication

Use Auth0 client credentials to obtain a token with catalog:read.

POST https://dev-0fzltgk7uli3w300.us.auth0.com/oauth/token
Content-Type: application/json

{
  "grant_type": "client_credentials",
  "client_id": "<CLIENT_ID>",
  "client_secret": "<CLIENT_SECRET>",
  "audience": "https://kardilo.com/api/v1/mcp"
}

The audience ends in /mcp but authorizes both REST and MCP catalogue calls. Send Authorization: Bearer <ACCESS_TOKEN> on every request.

Expiry and renewal​

The configured token lifetime is 24 hours. Use the exchange response's expires_in to renew before expiry; no refresh token is used in this flow. Cache tokens securely rather than exchanging credentials on every call.

Revoking a client stops new token issuance. Existing JWTs can remain valid until expiry. Ask your access contact to handle a suspected credential leak.

What a 401 means​

Missing, invalid, expired, wrong-audience or insufficient-scope credentials return 401 with WWW-Authenticate: Bearer. An ordinary collector login or the internal handbook password is not a catalogue credential.

Keep secrets on your server or in a local secret store. This portal never asks you to paste a token.