Authentication Guide
Authentication Guide
Choose the recommended OAuth 2.0 flow for new integrations or use Simple Auth to maintain an existing integration.
Base URL
OpenAPI Specification
Choose an Authentication Method
OAuth 2.0Recommended for new integrations. Use standard authorization, refresh, introspection, revocation, and PKCE flows.Recommended Simple AuthReference the existing /auth/v1/login flow used by legacy integrations.Existing integrations OAuth 2.0 OpenAPIDownload the recommended machine-readable OAuth 2.0 specification.Download oauth2.json
Authentication Basics
Both authentication methods produce bearer tokens accepted by the ZeyOS REST API.
OAuth 2.0 tokenObtain an access token from /oauth2/v1/token, preferably through the authorization-code flow with PKCE.
Bearer authenticationInclude Authorization: Bearer {token} in every REST API request, regardless of how the token was obtained.
Session cookieApplications running inside ZeyOS can use the existing ZEYOSID browser session instead of obtaining another token.
Token Lifecycle
ExpiryOAuth 2.0 access tokens expire after one hour; use the refresh token to obtain a replacement.
IntrospectUse /introspect to check whether a token is still active.
RevokeUse /revoke to invalidate a token explicitly (e.g. on logout).