Authentication

You'll need to authenticate your requests to access any of the endpoints in the Bob! Desk API. In this guide, we'll look at how authentication works. Bob! Desk offers one way to authenticate your API requests: OAuth2 with a token.

OAuth2 with bearer token

The Bob! Desk API authenticates every request with a bearer token. You will find your access token in the Bob! Desk Settings, section API Key. Here's how to add the token to the request header using cURL:

curl https://api.bob-desk.com/api/v3.0/ \
  -H "Authorization: Bearer {token}"

Always keep your token safe and reset it if you suspect it has been compromised.

Scopes and permissions

API tokens have no scopes: an active token gives access to every endpoint of the API v3.0, on behalf of the company that created it. There is no permission to add to a token for a given endpoint.

401 Unauthorized

Whatever the endpoint, the API answers 401 in two cases only:

• the Authorization header is missing or malformed. It must be exactly Authorization: Bearer {token}, with a capitalised Bearer;
• the token has been reset or deactivated.

If one endpoint answers 401 while the others accept the same token, check how the failing request builds its header: an HTTP client that drops the header on a redirect, a multipart helper that sets its own headers, or a different token in that part of your code.