Authentication

Token flow

Authenticate by exchanging your client credentials for a JWT:

curl -X POST https://api.easyplay.no/api_clients/token \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "YOUR_CLIENT_ID",
    "clientSecret": "YOUR_CLIENT_SECRET"
  }'

The returned token is valid for 24 hours. Send it on every request:

Authorization: Bearer <token>

Scopes

Access is per resource instance, not per endpoint. Each API client is granted a set of scopes with this shape:

{
  "operation": "read",
  "resource": "club",
  "id": "<resource-instance-id>"
}

• operation — read or write. The external API currently exposes read endpoints, so your scopes will typically be read.
• resource — the resource type, e.g. club.
• id — the ID of the specific resource instance the scope applies to.

A request is allowed only if your client holds a scope matching the operation, resource type, and resource instance. Requests outside your granted scopes — including undocumented endpoints — return 403 Forbidden.

Access is granted per club

Scopes grant access to a club's resources as a whole. When your client has read access to a club, that covers everything belonging to it — the club itself, its stadiums, and the live events for the club and its stadiums. You don't need separate scopes per stadium or event: every endpoint resolves to the owning club's scope.

Errors