The Give Interactive REST API uses OAuth2 client credentials. Obtain an access token first, then send it with every subsequent API call.

Obtaining credentials

Contact your account representative to request a Client ID and Client Secret. Each environment (sandbox and production) has its own credentials.

Additional credentials can be requested for a given environment. This enables better tracking of which integration made a change, but does not affect permissions at this time. Provide a user's contact information so the credentials can be associated with them.

Requesting an access token

• Sandbox: https://api-sandbox.giveinteractive.com/oauth/token

• Production: https://api.giveinteractive.com/oauth/token

Send a POST request with:

• Query parameter grant_type set to client_credentials

• Body (application/x-www-form-urlencoded) containing client_id and client_secret

A successful response includes an access_token, token_type, and expires_in (seconds). Send the access_token with subsequent API calls.

Note: Currently the access token is an opaque string, but this may be replaced with a JWT in the future.

Using the access_token

All subsequent calls will need to provide an Authorization header with the access_token.

Permissions

Currently, all calls to the REST API run under a system-level account with unlimited permissions. Additional issued credentials (see above) do not currently change what a request is permitted to do.

Authorization failures

Permission checks (for routes that use them) can respond with:

• 401 { "message": "Unauthorized" } — no client_id/client_secret was provided, or the client_id does not match.

• 403 { "message": "You don't have sufficient privileges." } — the caller lacks the required permission.

Token lifetime

The access-token response includes expires_in (seconds). The default expiration is two hours. Once a token expires, obtain a new one from /oauth/token.