# Authentication


# Authentication

AutoUncle CoDriver uses the **OAuth 2.1 client credentials** grant. Each API client belongs to one dealer organization and acts on that organization's data only.

## Create a client

An owner or admin creates it under **Settings → Developers → Create application**. The secret is shown once: store it in a secrets manager, never in source code or email.

Tick **Test client** while you build. Every lead a Test client pushes is a test lead: a label that keeps it out of reports and marks its events `"test": true`. It is still processed in full, messages to the customer and delivery to the dealer's CRM included, so build in a sandbox organization, where safe mode keeps anything from leaving AutoUncle CoDriver (see [Testing](/developers/testing)).

## Scopes

Ask for the narrowest scopes your integration needs.

| Scope | Allows |
|---|---|
| `leads_write` | `POST /api/v1/leads`; reading the status of the leads you pushed |
| `leads_read` | `GET /api/v1/leads/{id}` (no customer data) |
| `opportunities_read` | `GET /api/v1/opportunities…` and their appointments, including the customer's contact details |
| `events_read` | `GET /api/v1/events`. A client with this scope turns event recording on for the organization. |
| `org_all` | Everything above, plus the organization's MCP server |

## Get a token

```bash
curl -s -X POST https://codriver.autouncle.com/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials&scope=leads_write leads_read"
```

```json
{ "access_token": "eyJhbGciOiJSUzI1NiIs…", "token_type": "Bearer", "expires_in": 172800, "scope": "leads_write leads_read" }
```

Send it as `Authorization: Bearer <token>`. Tokens are RS256 JWTs (keys at `/.well-known/jwks.json`) and last 48 hours. Request a new one when you get `401 invalid_token`; don't request one per call.

Discovery metadata (RFC 8414): `/.well-known/oauth-authorization-server`.