Authentication

AutoUncle CoDriver uses the OAuth 2.1 client credentials grant. Each API client belongs to one dealer organization and acts on that organization's data only.

Create a client

An owner or admin creates it under Settings → Developers → Create application. The secret is shown once: store it in a secrets manager, never in source code or email.

Tick Test client while you build. Every lead a Test client pushes is a test lead: a label that keeps it out of reports and marks its events "test": true. It is still processed in full, messages to the customer and delivery to the dealer's CRM included, so build in a sandbox organization, where safe mode keeps anything from leaving AutoUncle CoDriver (see Testing).

Scopes

Ask for the narrowest scopes your integration needs.

Scope	Allows
leads_write	POST /api/v1/leads; reading the status of the leads you pushed
leads_read	GET /api/v1/leads/{id} (no customer data)
opportunities_read	GET /api/v1/opportunities… and their appointments, including the customer's contact details
events_read	GET /api/v1/events. A client with this scope turns event recording on for the organization.
org_all	Everything above, plus the organization's MCP server

Get a token

curl -s -X POST https://codriver.autouncle.com/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials&scope=leads_write leads_read"

{ "access_token": "eyJhbGciOiJSUzI1NiIs…", "token_type": "Bearer", "expires_in": 172800, "scope": "leads_write leads_read" }

Send it as Authorization: Bearer <token>. Tokens are RS256 JWTs (keys at /.well-known/jwks.json) and last 48 hours. Request a new one when you get 401 invalid_token; don't request one per call.

Discovery metadata (RFC 8414): /.well-known/oauth-authorization-server.