Skip to content
Anagen
PT EN
Request assessment

Guide 3/12

Authentication and scopes

Integrations authenticate with OAuth 2.0 client credentials at POST https://anagen.pt/api/v1/oauth/token (form or JSON body).

Request

  • grant_type=client_credentials
  • client_id and client_secret (body or HTTP Basic)
  • scope (optional, space separated): a subset of the scopes granted to the integration; omitted = all granted scopes.

Response

Standard OAuth response — outside the API envelope. Errors follow RFC 6749: invalid_client, invalid_grant, invalid_scope, unsupported_grant_type.

{
  "access_token": "8f3a…c21",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "crm.leads:editar agenda:ver"
}
{
  "error": "invalid_client",
  "error_description": "Credenciais inválidas."
}

Scopes

Each scope is one row of the clinic's permission matrix: module:ver (read) or module:editar (read and write). Inside the integration's clinic the scope is «all records». Administration modules (admin.*) are never available to integrations. Examples: crm.leads:editar, agenda:ver, financeiro.pagamentos:ver, indicadores.vendas:ver, equipa.tarefas:editar. The full list is in the reference (security scheme integracao).

Token lifetime and revocation

  • Access tokens last 3600 s; request a new one before it expires (there is no refresh token in this flow).
  • Changing scopes, networks, state or validity of the integration — or rotating the secret — ends all its tokens immediately (401 token_revogado).
  • Source IP restrictions return 403 ip_nao_permitido; browser origins not allowed by CORS return 403 origem_nao_permitida.

Team users (mobile app) and patients (portal) use different, interactive sign-ins; patient endpoints never accept integration tokens.