Assist24 Docs

Public API docs

API authentication

Use an access token limited to the OAuth client scopes.

OAuth client token

Obtain a Client ID, secret, and granted scopes from the administrator configuring access. Exchange the credentials server-side with the client credentials flow.

curl -X POST "$OAUTH_TOKEN_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "client_secret=$CLIENT_SECRET" \
  --data-urlencode "scope=$SCOPES"

Never put the secret in browser code or source control. Send the token in an Authorization: Bearer header and request only scopes granted to that client.

MCP exposes only chat operations allowed by the granted scopes. User tokens retain the signed-in user's permissions.

Generate a token in the GraphQL playground. Existing integration secrets cannot be recovered; the Client ID and client secret are shown only after creation. Request only the granted chat.read and chat.send scopes.

Copy a session ID token from the account section of the portal left menu. Its displayed validity is not your logout time; refresh can extend the session.

Open the GraphQL playground