OAuth 2.0 authentication

OAuth2 client credentials

SEEK Pass uses OAuth 2.0 with the Client Credentials grant type for server-to-server authentication. OAuth credentials (client_id and client_secret) are securely provisioned (e.g. via 1Password) for both staging and production environments. For more information on OAuth 2.0, please refer to OAuth 2.0 Authorization Framework.

Environments

The staging and production environment endpoints are provided below:

Staging: https://app.seekpass-staging.com
Production: https://app.seekpass.co

Request an OAuth access token by calling the OAuth token endpoint with the appropriate scope for your credential type (e.g. write.education, write.english_proficiency).

All API requests must include a User-Agent header. Requests without one will be rejected with a 403 Forbidden response. Most standard HTTP clients and libraries (e.g. Axios, Python Requests, curl) set this automatically, so no action is needed in most cases. If you are using a custom or low-level HTTP client, ensure a User-Agentheader is explicitly set, for example: User-Agent: YourAppName/1.0.

export SEEK_PASS_URL=https://app.seekpass-staging.com
export CLIENT_ID=<YOUR CLIENT ID>
export CLIENT_SECRET=<YOUR CLIENT SECRET>

curl --location $SEEK_PASS_URL/api/partner/v1/oauth/token.json \
--header 'Accept: application/json' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'User-Agent: curl/8.4.0' \
--data-urlencode grant_type=client_credentials \
--data-urlencode client_id=$CLIENT_ID \
--data-urlencode client_secret=$CLIENT_SECRET \
--data-urlencode 'scope=write.education'

Batch request

In order to use the batch request feature, you need to include all the requested types in the scope field in your OAuth token request.

This allows you to submit multiple credentials in a single API call.

Example:

curl -L $SEEK_PASS_URL/api/partner/v1/oauth/token.json \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode grant_type=client_credentials \
--data-urlencode client_id=$CLIENT_ID \
--data-urlencode client_secret=$CLIENT_SECRET \
--data-urlencode 'scope=write.microcredential write.education write.digital_identity'

Response codes

Below are the HTTP status codes returned by the SEEK Pass API. Understanding these response codes will help you handle different scenarios in your integration.

200 OK: Successful Authentication

{
    "access_token": "eyJhbGciOiJIUzUxMiJ9.eyJpYXQiOjE3NDAzNTkyNTEsImV4cCI6MTc.ZnOZlWaSeJx_ySk3Pl88Xy8KnPKc4EX",
    "token_type": "Bearer",
    "expires_in": 7199,
    "scope": "write.education",
    "created_at": 1736144436
}

Save the access_token for the next steps:

export ACCESS_TOKEN=eyJhbGciOiJIUzUxMiJ9.eyJpYXQiOjE3NDAzNTkyNTEsImV4cCI6MTc.ZnOZlWaSeJx_ySk3Pl88Xy8KnPKc4EX

Previous: Overview

Next: Revoke OAuth token