Authentication

Personal access tokens, OAuth tokens and scopes for the Forumulate REST API.

Embed
Preview of the card
<a href="https://forumulate.com/reference/authentication"><img src="https://forumulate.com/reference/_api/public/orgs/046a9bc0-d530-43ae-9bae-af7945008cda/spaces/8042f004-e3d9-445f-b7a4-b6c1f86836e6/pages/6d5d9524-b654-4f27-be4b-7399b6ad45df/social-card.svg?v=3e7ae33eec8b" alt="Authentication" width="600" height="315"></a>

Every call carries a bearer token. A personal access token (cft_…) belongs to a person and is minted under Account → Tokens. An OAuth token (cfo_…) belongs to an application a customer installed. Both are checked the same way.

Usage

curl -H "Authorization: Bearer $FORUMULATE_TOKEN" \
  https://forumulate.com/api/orgs

Parameters

  • read — read anything the owner can read.

  • write — create and update content. Includes read.

  • admin — settings, members, tokens. Includes write.

A token never grants more than the person behind it has: scopes narrow, they do not widen.

Returns

A JSON body, always. Errors carry { "error": { "code", "message" } } with a stable code — match on that, not on the sentence.

Examples

Tokens can expire. Set an expiry when you mint one, and rotate on a schedule; a leaked token is revoked from the same screen and stops working immediately.

The Forumulate teamUpdated
#api