Authentication

The ThinkLP APIs use OAuth 2.0 Client Credentials. You exchange a client ID
and secret for a short-lived access token, then send that token as a bearer
token on every request. There are no user logins or session cookies.

Prerequisites

Your ThinkLP administrator provisions an external client app and shares two
values with you:

You also need your org's My Domain host (for example,
acme.my.salesforce.com). Every URL below uses it.

Step 1 — Request an access token

POST to your org's token endpoint with the client_credentials grant:

curl -X POST 'https://acme.my.salesforce.com/services/oauth2/token' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'client_secret=YOUR_CLIENT_SECRET'

A successful response returns an access token:

{
	"access_token": "00D...!AQ...",
	"token_type": "Bearer",
	"issued_at": "1751990400000",
	"instance_url": "https://acme.my.salesforce.com"
}

Step 2 — Authorize your requests

Send the token in the Authorization header on every API call:

curl 'https://acme.my.salesforce.com/services/apexrest/ThinkSDK/thinklp/api/v1/theft-cases?id=a0nXXXXXXXXXXXXXXX' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Token lifetime

Client-credentials tokens are short-lived and cannot be refreshed — request a
new one when the current token expires (a 401 response indicates an expired or
invalid token). Cache and reuse a token across requests until it expires rather
than requesting one per call.

Security notes

• Treat the client secret like a password. Never embed it in client-side code or
  commit it to source control.
• All requests must be made over HTTPS.
• Access is governed by the permissions of the app's run-as user, including
  Salesforce field-level security. A request for a field the app cannot see
  returns FLS_DENIED (see Errors).