OAuth tokens

An EventThing OAuth access token represents a user-authorised grant to a specific application.

It is not a VTC API token.

OAuth user token

An OAuth user token represents:

OAuth application
        +
EventThing user
        +
accepted scopes
        +
applicable VTCs

For a normal integration, the token can be used to create an invitation:

POST /v1/invites

alongside the OAuth protocol endpoints required to complete the authorisation flow.

It cannot be used for wider VTC management.

For example, an OAuth user token cannot be used to:

• manage existing invitations
• create or modify events
• manage discussions
• manage blocks
• retrieve members
• change VTC settings
• create API tokens
• perform other VTC administration

VTC API token

A VTC API token is different.

It belongs to one VTC and can use the wider EventThing API according to the permissions granted to that token.

For example:

events:read
events:write

invites:read
invites:write
invites:respond

discussions:read
discussions:write

blocks:read
blocks:write

A VTC API token cannot simply switch to another VTC.

Its authority remains attached to the VTC the token was created for.

Why keep them separate?

The two token types solve different problems.

OAuth user token

A person has authorised an external application
to perform a very specific action on their behalf.

Whereas:

VTC API token

A VTC has authorised an integration to interact
with EventThing programmatically.

Keeping those credential types separate means an OAuth application never accidentally inherits the wider powers available to a VTC integration.