Token

The Admin API uses OAuth 2.0 (RFC 6749) with the client credentials grant for server-to-server authentication.

Prerequisites

Register your application in the Fire spark dashboard to obtain a client_id and client_secret. Store the client secret on your server only.

Client credentials grant

Use this grant for back-office tools, CRM sync jobs, reporting pipelines, and migration scripts. Request an access token directly from the token endpoint.

curl -X POST "https://firespark.cloud/api/admin/v1/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=customers:read customers:write orders:read"

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "customers:read customers:write orders:read"
}

Token request parameters

Parameter	Required	Description
`grant_type`	Yes	Must be `client_credentials`.
`client_id`	Yes	Your application client ID.
`client_secret`	Yes	Your application client secret.
`scope`	No	Space-delimited list of scopes. Defaults to the scopes configured for your application.

Use the access token

Include the access token in the Authorization header of every authenticated request.

curl "https://firespark.cloud/api/admin/v1/customers/bulk?from=0&to=100" \
  -H "Authorization: Bearer ACCESS_TOKEN"

Access tokens expire after the number of seconds indicated by expires_in. Request a new token before expiry. Do not expose client secrets or access tokens in client-side code.

Error responses

Token and authorization errors follow RFC 6749. The token endpoint returns application/json with an error field.

Error	Description
`invalid_request`	A required parameter is missing or malformed.
`invalid_client`	Client authentication failed.
`invalid_grant`	The provided credentials are invalid.
`unauthorized_client`	The client is not authorized for this grant type.
`unsupported_grant_type`	The `grant_type` value is not supported.
`invalid_scope`	The requested scope is invalid or exceeds what is allowed.

Error

{
  "error": "invalid_client",
  "details": "Client authentication failed."
}

Body

application/x-www-form-urlencoded

grant_type

enum<string>

required

Available options:

client_credentials

client_id

string

required

client_secret

string

required

scope

string

Space-delimited scopes such as menus:write stores:read orders:read.

Response

200 - application/json

data

any

API Documentation

Endpoints

Guides

Resources

Prerequisites

Client credentials grant

Token request parameters

Use the access token

Error responses

Body

Response

​Prerequisites

​Client credentials grant

​Token request parameters

​Use the access token

​Error responses

Body

Response

Prerequisites

Client credentials grant

Token request parameters

Use the access token

Error responses