Installation

Examples

Getting the latest notes

example.js

run it

using the OAuth client credentials grant to authenticate

When running reports locally OAuth can be used to authenticate:

using the OAuth device code grant to authenticate

When running reports locally OAuth can be used to authenticate:

How it works

On first run, the API client will:

1. Prompt the user for an intermediate DCR OAuth client ID and cache it per API hostname in ~/.bipsyncapi
2. Use this intermediate client to request an OAuth token with the oauth:dcr scope via the device authorization flow
3. The user will be prompted to complete authorization in their browser
4. Once authorized, fetch the list of available scopes
5. Use the oauth:dcr-scoped token to register a new OAuth client with the required scopes via Dynamic Client Registration (RFC 7591)
6. Cache the newly registered client per API hostname in ~/.bipsyncapi
7. Prompt for team ID and cache it per API hostname after successful authentication
8. Use the cached client + credentials to obtain an access token with all available scopes plus the team-specific scope
9. Use this access token to make authenticated API requests

On subsequent runs:

• The cached intermediate client ID, registered client, and team ID are reused
• To change the cached team ID or intermediate client ID, edit or delete the corresponding field for the API hostname in ~/.bipsyncapi
• If the available scopes change in the main app, a new client will be registered via the device / DCR flow

The user approving the device code must have the OAuth Dynamic Client Registration permission enabled in the Can Access section of their Access tab in the admin app.