Authentication

The Addigence API uses OAuth2 Client Credentials for authentication. You exchange your client_id and client_secret for a short-lived bearer token, then include that token in all subsequent API requests.

Obtaining credentials

API clients are provisioned through the Addigence dashboard. Each client receives a client_id (prefixed with adg_) and a client_secret. The secret is shown only once at creation time — store it securely.

Token exchange

curl -X POST https://app.addigence.com/api/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "adg_01JSGV7A...",
    "client_secret": "your-client-secret",
    "scope": "strategies:read strategy_versions:read"
  }'

{
  "access_token": "dGhpcyBpcyBhbiBleGFtcGxlIHRva2Vu...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "strategies:read strategy_versions:read"
}

Using the token

Include the bearer token in the Authorization header of all /api/v1 requests:

curl https://app.addigence.com/api/v1/strategies/019d6f6a-9be4-7d69-a04c-91912a8b9100 \
  -H "Authorization: Bearer dGhpcyBpcyBhbiBleGFtcGxlIHRva2Vu..."

Tokens expire after 1 hour (3600 seconds). When your token expires, request a new one from the token endpoint. Expired tokens return a 401 error with "error": "invalid_token".

Rate limiting

The token endpoint is protected by rate limiting. If you exceed 10 requests within 60 seconds from the same IP address, you will be temporarily banned for 5 minutes.

Rate-limited requests receive a 429 response:

{
  "error": "rate_limited",
  "error_description": "Too many requests, try again later"
}

Scopes

Scopes control which API actions a token can perform. When creating a token, you can request a subset of the client's allowed scopes using the scope parameter.