Authentication
The Movemint API uses OAuth 2.0 for authentication and authorization. All API entity requests require a valid Bearer token.
Supported Grant Types
Authorization Code
Server-side applications that can securely store a client secret
Client Credentials
Machine-to-machine communication with no user context
Step 1: Register an OAuth Application
Contact the Movemint team to register your OAuth application. You will receive a Client ID (client_id) and Client Secret (client_secret). You must also provide one or more Redirect URIs where users will be sent after authorizing your application.
Step 2: Authorization Code Flow
Redirect the user's browser to the authorization endpoint:
GET https://www.movemint.cc/oauth/authorize
?client_id=YOUR_CLIENT_ID
&redirect_uri=YOUR_REDIRECT_URI
&response_type=code
&scope=After the user approves access, they are redirected back to your redirect_uri with an authorization code query parameter:
https://your-app.com/callback?code=AUTHORIZATION_CODEStep 3: Exchange the Code for Tokens
curl -X POST https://www.movemint.cc/oauth/token \
-d grant_type=authorization_code \
-d code=AUTHORIZATION_CODE \
-d client_id=YOUR_CLIENT_ID \
-d client_secret=YOUR_CLIENT_SECRET \
-d redirect_uri=YOUR_REDIRECT_URIResponse:
Access tokens expire after 2 hours (7200 seconds) by default.
Step 4: Refresh an Expired Token
Step 5: Use the Token in API Requests
Include the access token as a Bearer token in the Authorization header:
Revoking Tokens
To revoke an access token or refresh token:
Exchange an authorization code or refresh token for an access token. This endpoint supports the authorization_code, refresh_token, and client_credentials grant types.
Token issued successfully
The access token to use in API requests
Always "Bearer"
Token lifetime in seconds (default 7200 = 2 hours)
7200Token used to obtain a new access token when the current one expires. Not present for client_credentials grants.
Unix timestamp of when the token was created
Invalid grant or request
Invalid client credentials
POST /oauth/token HTTP/1.1
Host: www.movemint.cc
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 128
"grant_type='authorization_code'&code='text'&client_id='text'&client_secret='text'&redirect_uri='https://example.com'"{
"access_token": "dG9rZW5fZXhhbXBsZQ",
"token_type": "Bearer",
"expires_in": 7200,
"refresh_token": "cmVmcmVzaF90b2tlbl9leGFtcGxl",
"created_at": 1700000000
}Revoke an access token or refresh token. After revocation, the token can no longer be used to access protected resources.
The access token or refresh token to revoke
Your application's Client ID
Your application's Client Secret
Token revoked successfully (always returns 200, even if the token was already revoked)
No content
Invalid request
POST /oauth/revoke HTTP/1.1
Host: www.movemint.cc
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 58
"token='text'&client_id='text'&client_secret='text'"No content
Retrieve metadata about the current access token, including its scopes, expiration, and associated resource owner and application.
Pass the access token in the Authorization header:
Authorization: Bearer YOUR_ACCESS_TOKEN
Token information
The ID of the athlete who authorized the token
List of scopes granted to this token
Seconds until the token expires
Unix timestamp of when the token was created
Token is invalid or expired
GET /oauth/token/info HTTP/1.1
Host: www.movemint.cc
Authorization: Bearer Paste your OAuth access token here
Accept: */*
{
"resource_owner_id": 1,
"scopes": [
"text"
],
"expires_in_seconds": 1,
"application": {
"uid": "text"
},
"created_at": 1
}Last updated