Choose the right credential
Credentials are scoped to different tasks. A token that succeeds on one endpoint may be invalid on another.
For the manual browser-login test, start with your public client ID; the script generates the other attempt values, and the token request later issues an access token. You do not need to create a developer token or workspace API token for that test.
For the first management API request, create a developer access token in Settings. For an application user's profile request, use the application token returned by that user's login. Match the task before choosing a credential from the table.
| Credential | Where you obtain it | Where you use it |
|---|---|---|
| Developer access token | Dashboard Settings → General → Developer Access Tokens | X-Developer-Token on management /developer/... endpoints |
| Public OAuth client ID | Application/OAuth client configuration | client_id during OAuth; oauth_client in application login/registration |
| Confidential client secret | Confidential client creation or secret reset | Server-side OAuth client authentication |
| Application token | Successful /login/ or completed application MFA/sign-in flow | Bearer authorization on /user/profile/ and application-user APIs |
| OAuth access token | /oauth/token/ | Bearer authorization on /oauth/userinfo/ and the OAuth resources that accept it |
| OAuth refresh token | Token response when issued for your grant | grant_type=refresh_token on /oauth/token/ |
| Registration API key | Registration API access provisioned for your account | X-API-Key on JSON /register/ |
| Workspace API token | Workspace API tokens screen or /developer/tokens/ | Only integrations explicitly accepting that token type |
| SCIM token | Workspace SCIM screen | Bearer authorization on /scim/v2/... |
Developer access tokens
Select only the scopes your automation needs. The operation reference gives the required scope, such as read_workspaces or write_users. The api scope grants broad management access; do not choose it just to silence an unexplained error. Expire/revoke tokens when their job is complete. Copy new tokens at creation because later reads hide the plaintext.
Start with the token creation instructions. If your existing token lacks a required scope, create a token with the scopes needed for that task and use its new value in your request. Adding a scope name to the request body or changing OAuth client scopes does not change a developer token's permissions. The management walkthrough maps its required scopes to dashboard labels.
Copy credentials exactly as issued, including any prefix; these are not values you invent. In X-Developer-Token: YOUR_DEVELOPER_TOKEN, replace only the placeholder. In Authorization: Bearer YOUR_APPLICATION_TOKEN, keep the literal word Bearer and replace only the token placeholder.
Registration API key
JSON signup requires a registration API key accepted for your account. The workspace API token created by Quick Build is not interchangeable with this key. If your account has not been provisioned for JSON registration, contact SyAuth support to confirm availability and obtain the correct credential. These docs do not assume a self-service key-issuance screen exists.
Use hosted registration or create a test user through authorized developer user management while setting up an integration. Keep registration keys in your server configuration; send your custom signup form to your own server, which makes the SyAuth registration request.
Secret storage and token families
Keep developer tokens, registration keys, confidential client secrets and social-provider secrets on your server or in a secret manager. Your browser may know a public client ID; that ID is not a secret. Never put management credentials into browser environment variables or committed code.
The token returned as token by /login/ belongs to a different flow from OAuth's access_token. An OAuth refresh request cannot refresh the separate application-login token. An ID token identifies a sign-in event; use an access token for API authorization.