# EchoSync Authorizer API

The EchoSync Authorizer API is the authentication service for the EchoSync
platform. It validates your application credentials and issues OAuth 2.0
Bearer tokens that grant access to EchoSync APIs.

Every API request must include a valid Bearer token in the `Authorization`
header:
```
Authorization: Bearer {your_token}
```

## Token Lifecycle

> **Important**
> **Reuse your token until it expires.** Do not request a new token on every API call. 
> Cache the token and use it for its full validity period. 
> Requesting new tokens repeatedly within the same validity window may trigger rate limiting.

- Access tokens are valid for **86400 seconds** (24 hours) from the time they are issued.
- The endpoint `/token` response includes:
  - `expires_in` — token lifetime in **seconds** (used to determine when the token should be refreshed)
  - `scope` — the permissions granted to the token, defining which APIs it can access
- A `401 Unauthorized` response from any EchoSync API indicates the token is expired or invalid. 
  In this case, request a new token and retry the request.

## Rate Limiting

To ensure fair usage, maintain service availability, and protect system performance, requests may be subject to rate limiting. 
When usage exceeds allowed thresholds, requests can be temporarily throttled or rejected until the limit window resets.


Version: 1.0.0

## Servers

Production
```
https://auth.echo.com
```

## Security

### basicAuth

Type: http
Scheme: basic

### apiKey

Type: apiKey
In: header
Name: x-api-key

## Download OpenAPI description

 - [EchoSync Authorizer API](https://echo-api.redocly.app/_bundle/authorizer-api/openapi.yaml)

## token

 - [POST /token](https://echo-api.redocly.app/authorizer-api/openapi/token/token.md): Exchanges your application credentials for an OAuth 2.0 Bearer token using the Client Credentials flow. Submit your `client_id`, `client_secret`, `grant_type`, and `scope` as form fields. On success,