Authentication

Step 1: Get your credentials

1. Log in to RCS Studio
2. Navigate to the Developer tab
3. Click Create credentials to generate a new Client ID and Client Secret
4. Copy both values and store them securely — the Client Secret is only shown once

⚠️

If you lose your Client Secret, you must generate a new set of credentials. There is no way to retrieve it after creation.

Step 2: Exchange credentials for a token

Send a POST request to the token endpoint with your credentials in the Authorization header as a Base64-encoded client_id:client_secret pair.

curl -X POST https://auth.rcsstudio.ai/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials"

const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');

const response = await fetch('https://auth.rcsstudio.ai/oauth2/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': `Basic ${credentials}`,
  },
  body: 'grant_type=client_credentials',
});

const { access_token, expires_in } = await response.json();

Token response

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Step 3: Use your token

Include the token as a Bearer in the Authorization header on every API request. See API conventions for a first example request to verify your setup.

Refreshing a token

Tokens expire after 1 hour. There is no refresh token — when your token expires, repeat Step 2 to get a new one.

A 401 Unauthorized response means your token has expired. To avoid failed requests, use the expires_in value from the token response to proactively refresh before expiry rather than waiting for a 401.

# Repeat the same request to get a fresh token
curl -X POST https://auth.rcsstudio.ai/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d "grant_type=client_credentials"

Best practices

• Cache the token — store it in memory or a short-lived cache and reuse it across requests. Requesting a new token on every API call is unnecessary and slow.
• Refresh proactively — schedule a refresh based on expires_in, not in response to a 401.
• Keep credentials server-side — your Client Secret must never appear in client-side code (browsers or mobile apps). Admin API credentials are for server-to-server integrations only.
• Use a secrets manager — store Client ID and Client Secret in environment variables or a secrets manager, never in source code.