Which endpoints accept OAuth tokens?

Available Endpoints#

The Approvals API uses its own workspace:approvals:* scopes. See Scopes.

Other endpoints return 403 oauth_not_allowed. Use an API key for those.

Errors#

Template endpoints currently return a plain 401 with no code for expired tokens, workspace_not_accessible and sandbox_restricted.

Dynamic Client Registration#

MCP clients (Claude, Cursor and others) can register themselves with POST /v1/oauth/register (RFC 7591). The discovery document at /.well-known/oauth-authorization-server lists it as registration_endpoint.

curl -X POST https://api.orshot.com/v1/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "My MCP Client",
    "redirect_uris": ["http://localhost:3334/callback"]
  }'

redirect_uris is required and must be a non-empty array. The call does not create a new app. It returns 201 with a public client_id (no secret), plus client_name, redirect_uris, grant_types, token_endpoint_auth_method: "none", scope and client_id_issued_at. The consent screen names Orshot, not your client. Use that client_id with the Authorization Code flow.

To build your own app with its own name on the consent screen, register an app instead.