All requests to the BEEM API require a bearer token in the Authorization header:

Authorization: Bearer <your-token>

There are two ways to get one. For most integrations, OAuth 2.0 is the right choice — your users sign in with their BEEM accounts and the rest is automatic. For one-off scripts and local development, you can use a token copied from the BEEM web app.

Option 1 — OAuth 2.0 (recommended)

BEEM uses Auth0 with PKCE-protected Authorization Code flow. From the Try It panel in this reference, the round-trip is:

Open any operation and find the Credentials dropdown.
Choose OAuth2.
Paste the BEEM Client ID:
```
<your-spa-client-id>
```
Leave the Secret field empty — it's not used with PKCE.
Click Authorize.
Sign in to your BEEM account in the popup that opens.
The popup closes automatically and the token is attached to all subsequent requests in the Try It panel.

Why is the Client ID public? PKCE (Proof Key for Code Exchange) replaces the client secret with a per-session code challenge that only the original requester can complete. The Client ID alone can't be used to impersonate the application — that's the whole point of the design. See RFC 7636.

For your own application

If you're building a user-facing app that talks to the BEEM API, implement the standard OAuth 2.0 Authorization Code flow with PKCE against:


Authorization endpoint	`https://auth0.app.beemdata.com/authorize`
Token endpoint	`https://auth0.app.beemdata.com/oauth/token`
Audience	`https://api.beemdata.com`
Required scopes	`openid email profile`
Optional scope	`offline_access` (for refresh tokens)

Pass audience=https://api.beemdata.com on the authorization request. Without it, Auth0 returns an ID token instead of an API access token, and BEEM will reject it.

Standard libraries that handle PKCE for you:

JavaScript: @auth0/auth0-spa-js
Python: authlib
Mobile: Auth0 native SDKs

For server-to-server integrations

If you're calling BEEM from a backend with no user in the loop, use the Client Credentials flow with a Machine-to-Machine application. Contact BEEM support to get a dedicated client_id / client_secret pair.

curl -X POST https://auth0.app.beemdata.com/oauth/token \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "<your m2m client id>",
    "client_secret": "<your m2m secret>",
    "audience": "https://api.beemdata.com"
  }'

The response includes an access_token good for the lifetime configured on your application (typically 24 hours).

Option 2 — Copy a token from your browser

For quick scripts, debugging, or local development you can grab a token from a browser session:

Sign in at https://app.beemdata.com.
Open developer tools (F12 or ⌘⌥I).
Go to the Network tab.
Refresh the page or click around in the app.
Find any request to api.beemdata.com.
Copy the value of the Authorization header (everything after Bearer ).

In the Try It panel, choose Bearer in the Credentials dropdown and paste the token. It's good for about an hour, after which you'll need to repeat the process.

This is fine for development. Don't ship browser-extracted tokens in production code — use the OAuth flow above instead.

Token contents

The access token is a JWT signed by Auth0. You can decode it at jwt.io to inspect its claims:

Claim	Meaning
`sub`	Stable identifier for the BEEM user
`aud`	Should be `https://api.beemdata.com`
`iss`	Should be `https://auth0.app.beemdata.com/`
`exp`	Expiration (Unix epoch)
`scope`	Space-separated list of granted scopes

If a request returns 401 Unauthorized and the token's aud claim isn't https://api.beemdata.com, you got an ID token instead of an access token — re-check that you're passing audience on the authorization request.