> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sparkserv.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate server-to-server requests and select the right scopes and dealership context.

Sparkserv uses OAuth 2.0 client credentials. Send a JSON request to `https://auth.sparkserv.com/oauth/token` with:

| Field | Value |
| - | - |
| `grant_type` | `client_credentials` |
| `client_id` | Your Spark API client ID |
| `client_secret` | Your Spark API client secret |
| `audience` | `https://api.sparkserv.com/public` |
| `scope` | A space-separated string of the action scopes you need |

The [quickstart](https://docs.sparkserv.com/quickstart.md) includes a complete token request. To follow the booking guide, change its scope value to `dealerships:read scheduling:read appointments:create` and obtain a new token.

> [!WARNING]
>
> Keep client secrets and access tokens on your server. Do not include them in browser applications, source control, screenshots, or shared logs.

## Choose scopes

Request only the actions your integration needs. Required scopes must be granted both in the token and on the active Spark API client.

| Scope | Actions |
| - | - |
| `dealerships:read` | List accessible dealerships |
| `scheduling:read` | Discover departments, services, advisors, transports, and availability |
| `customers:read` | Search authorized Spark customers and their saved vehicles |
| `appointments:create` | Book an appointment |
| `appointments:read` | Read or search Spark appointment snapshots |
| `appointments:update` | Update an appointment |
| `appointments:cancel` | Cancel an appointment |

Customer search is optional for the inline-customer booking flow. Request `customers:read` only if you use it.

## Send API requests

Use the API origin `https://api.sparkserv.com` with the `/public/v1/...` paths shown in the reference. The `/public/api/swagger.json` URL hosts the specification; it is not the base path for endpoint requests.

Send your token in the `Authorization` header:

```http theme={null}
Authorization: Bearer YOUR_ACCESS_TOKEN
```

For customer search, scheduling discovery, appointment creation, and appointment search, also send:

```http theme={null}
Dealership-Id: DEALERSHIP_UUID
```

Get that UUID from `GET /public/v1/dealerships`. Appointment read, update, and cancellation requests identify the appointment in the URL and do not require this header.

Dealership access follows the API client's acting-user team memberships. Knowing a dealership or appointment ID does not grant access to it.

## Troubleshoot access

| Response | What to check |
| - | - |
| `401` | The token may be missing, invalid, or expired, or the client may be inactive. Obtain a valid token for an active client. |
| `403` | The token or active API client may lack the action scope. Check both grants. |
| `404` | The resource may not exist, or it may be outside your client's dealership access. |

Contact [support@sparkserv.com](mailto:support@sparkserv.com) for credential or permission changes. Do not send your client secret or token.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.