Authentication

The Movemint API uses OAuth 2.0 for authentication and authorization. All API entity requests require a valid Bearer token.

Supported Grant Types

Grant Type	Use Case
Authorization Code	Server-side applications that can securely store a client secret
Client Credentials	Machine-to-machine communication with no user context

Step 1: Register an OAuth Application

Contact the Movemint team to register your OAuth application. You will receive a Client ID (client_id) and Client Secret (client_secret). You must also provide one or more Redirect URIs where users will be sent after authorizing your application.

Step 2: Authorization Code Flow

Redirect the user's browser to the authorization endpoint:

GET https://www.movemint.cc/oauth/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=

After the user approves access, they are redirected back to your redirect_uri with an authorization code query parameter:

https://your-app.com/callback?code=AUTHORIZATION_CODE

Step 3: Exchange the Code for Tokens

curl -X POST https://www.movemint.cc/oauth/token \
  -d grant_type=authorization_code \
  -d code=AUTHORIZATION_CODE \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d redirect_uri=YOUR_REDIRECT_URI

Response:

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 7200,
  "refresh_token": "REFRESH_TOKEN",
  "created_at": 1700000000
}

Access tokens expire after 2 hours (7200 seconds) by default.

Step 4: Refresh an Expired Token

curl -X POST https://www.movemint.cc/oauth/token \
  -d grant_type=refresh_token \
  -d refresh_token=REFRESH_TOKEN \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

Step 5: Use the Token in API Requests

Include the access token as a Bearer token in the Authorization header:

curl -H "Authorization: Bearer ACCESS_TOKEN" \
  https://www.movemint.cc/api/v1/me

Revoking Tokens

To revoke an access token or refresh token:

curl -X POST https://www.movemint.cc/oauth/revoke \
  -d token=TOKEN_TO_REVOKE \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

Obtain or refresh an access token

post

Exchange an authorization code or refresh token for an access token. This endpoint supports the authorization_code, refresh_token, and client_credentials grant types.

Body

application/x-www-form-urlencoded

or

or

Responses

200

Token issued successfully

application/json

access_tokenstringRequired

The access token to use in API requests

token_typestring · enumRequired

Always "Bearer"

Possible values:

expires_inintegerRequired

Token lifetime in seconds (default 7200 = 2 hours)

Example: 7200

refresh_tokenstringOptional

Token used to obtain a new access token when the current one expires. Not present for client_credentials grants.

created_atintegerRequired

Unix timestamp of when the token was created

400

Invalid grant or request

application/json

401

Invalid client credentials

application/json

post/oauth/token

HTTPcURLJavaScriptPython

POST /oauth/token HTTP/1.1
Host: www.movemint.cc
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 128

"grant_type='authorization_code'&code='text'&client_id='text'&client_secret='text'&redirect_uri='https://example.com'"

{
  "access_token": "dG9rZW5fZXhhbXBsZQ",
  "token_type": "Bearer",
  "expires_in": 7200,
  "refresh_token": "cmVmcmVzaF90b2tlbl9leGFtcGxl",
  "created_at": 1700000000
}

Revoke a token

post

Revoke an access token or refresh token. After revocation, the token can no longer be used to access protected resources.

Body

application/x-www-form-urlencoded

tokenstringRequired

The access token or refresh token to revoke

client_idstringRequired

Your application's Client ID

client_secretstringRequired

Your application's Client Secret

Responses

200

Token revoked successfully (always returns 200, even if the token was already revoked)

No content

400

Invalid request

application/json

post/oauth/revoke

HTTPcURLJavaScriptPython

POST /oauth/revoke HTTP/1.1
Host: www.movemint.cc
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 58

"token='text'&client_id='text'&client_secret='text'"

No content

Get token info

get

Retrieve metadata about the current access token, including its scopes, expiration, and associated resource owner and application.

Authorizations

bearerAuthoauth2

AuthorizationstringRequired

Pass the access token in the Authorization header:

Authorization: Bearer YOUR_ACCESS_TOKEN

Responses

200

Token information

application/json

resource_owner_idinteger · int64Optional

The ID of the athlete who authorized the token

scopesstring[]Required

List of scopes granted to this token

expires_in_secondsintegerRequired

Seconds until the token expires

created_atintegerRequired

Unix timestamp of when the token was created

401

Token is invalid or expired

application/json

get/oauth/token/info

HTTPcURLJavaScriptPython

GET /oauth/token/info HTTP/1.1
Host: www.movemint.cc
Authorization: Bearer Paste your OAuth access token here
Accept: */*

{
  "resource_owner_id": 1,
  "scopes": [
    "text"
  ],
  "expires_in_seconds": 1,
  "application": {
    "uid": "text"
  },
  "created_at": 1
}