> ## Documentation Index
> Fetch the complete documentation index at: https://docs-hub-campaign.convertt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Autenticação

> OAuth 2.0 com Client Credentials e Refresh Tokens

A API utiliza OAuth 2.0 com dois grant types: **Client Credentials** (para obter o primeiro token) e **Refresh Token** (para renovar sem reenviar o secret).

## Gerando Credenciais

1. Acesse o dashboard em [**Configurações**](https://hub-campaign.convertt.ai/settings) > **Credenciais da API**
2. Clique em **Gerar Novas Credenciais**
3. Salve o `client_id` e o `client_secret` — o secret só é exibido **uma vez**

## Obtendo um Access Token

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://api-hub-campaign.convertt.ai/api/v1/oauth/token \
    -H "Content-Type: application/json" \
    -d '{
      "grant_type": "client_credentials",
      "client_id": "rcs_a1b2c3d4e5f6...",
      "client_secret": "seu-client-secret-aqui"
    }'
  ```

  ```python Python theme={null}
  import requests

  response = requests.post(
      "https://api-hub-campaign.convertt.ai/api/v1/oauth/token",
      json={
          "grant_type": "client_credentials",
          "client_id": "rcs_a1b2c3d4e5f6...",
          "client_secret": "seu-client-secret-aqui"
      }
  )

  tokens = response.json()
  access_token = tokens["access_token"]
  ```

  ```javascript Node.js theme={null}
  const response = await fetch('https://api-hub-campaign.convertt.ai/api/v1/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      grant_type: 'client_credentials',
      client_id: 'rcs_a1b2c3d4e5f6...',
      client_secret: 'seu-client-secret-aqui'
    })
  });

  const { access_token, refresh_token } = await response.json();
  ```
</CodeGroup>

### Resposta

```json theme={null}
{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "a1b2c3d4e5f6...",
  "scope": "campaigns:dispatch"
}
```

## Usando o Access Token

Inclua o token no header `Authorization`:

```bash theme={null}
curl -X POST https://api-hub-campaign.convertt.ai/api/v1/external/campaigns/dispatch \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{ ... }'
```

## Renovando com Refresh Token

O access token expira em **1 hora**. Use o refresh token para obter um novo par sem reenviar o client secret:

```bash theme={null}
curl -X POST https://api-hub-campaign.convertt.ai/api/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "seu-refresh-token"
  }'
```

<Note>
  O refresh token usa **rotation**: cada uso gera um novo refresh token e invalida o anterior. O refresh token expira em **30 dias**.
</Note>

## Segurança

<Warning>
  * Nunca exponha o `client_secret` em código client-side (frontend, mobile)
  * Use variáveis de ambiente para armazenar as credenciais
  * Revogue credenciais comprometidas imediatamente no dashboard
</Warning>