Your first API call

Use a local Node.js script or your server. Supply KARDILO_CLIENT_ID and KARDILO_CLIENT_SECRET through your secret store before running the example. It keeps the access token in memory and prints only the set response.

const clientId = process.env.KARDILO_CLIENT_ID;
const clientSecret = process.env.KARDILO_CLIENT_SECRET;
if (!clientId || !clientSecret) throw new Error('Missing partner credentials');
const auth = await fetch('https://dev-0fzltgk7uli3w300.us.auth0.com/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    grant_type: 'client_credentials',
    client_id: clientId,
    client_secret: clientSecret,
    audience: 'https://kardilo.com/api/v1/mcp',
  }),
});
if (!auth.ok) throw new Error(`Token exchange: HTTP ${auth.status}`);
const { access_token: token } = await auth.json();
if (typeof token !== 'string' || !token) throw new Error('Missing access token');
const result = await fetch('https://kardilo.com/api/v1/catalog/sets', {
  headers: { Authorization: `Bearer ${token}` },
});
if (!result.ok) throw new Error(`Catalogue: HTTP ${result.status}`);
console.log(JSON.stringify(await result.json(), null, 2));

Expected result

HTTP 200 and a data array of sets. Choose a returned set id or code, then request its cards. Use a returned card id for card details.

Already have an access token in KARDILO_ACCESS_TOKEN?

curl --fail-with-body --silent --show-error \
  'https://kardilo.com/api/v1/catalog/sets' \
  -H "Authorization: Bearer ${KARDILO_ACCESS_TOKEN}"

A 401 means the catalogue token was rejected. Check authentication before retrying. Collector sessions do not grant catalogue access.