The Daylite API uses OAuth 2.0 for authentication. If you're just getting started or building something for your own account, the quickest path is a personal token — no app registration required.

If you're building an integration that other Daylite users will authorize through your app, you'll need to register an OAuth application. Follow the steps below to get set up.

Getting Started with OAuth

Step 1: Register your application

To register a new application, fill out the App Registration form. We will need the following information from you:

Field	Description
Application name	Name of your application
Application identifier	A reverse DNS style identifier, like `com.mycompany.mygreatdayliteapp`
Organization	The name of the organization affiliated with your app
Support email	An email address users of your app can contact for support
Requested Scopes	List of requested OAuth scopes. See the OAuth Scopes table below
Redirect URLs	URLs where the user will be redirected after authorization is complete

OAuth Scopes


`daylite:read`	Read access to all Daylite data
`daylite:write`	Write access to all Daylite data

Step 2: Authenticate the user

The authentication is an OAuth 2.0 flow — the user signs in with their Marketcircle credentials, authorizes your app to access Daylite, and your app receives a code it can exchange for an access token.

See the OAuth 2.0 RFC section 1.2 to learn more about the authentication flow.

OAuth 2.0 Endpoints

Endpoint	Description	Required Parameters
https://www.marketcircle.com/account/oauth/authorize	Page where the user authorizes your application to access Daylite data	Query Parameters - `client_id` — the identifier of your application - `redirect_uri` — URL where the user will be redirected after authorization - `scopes` (optional) — must be a subset of the scopes requested during registration
https://www.marketcircle.com/account/oauth/token	Exchange an `authorization_code` or `refresh_token` for an `access_token`	x-www-form-urlencoded body in `POST` with - `client_secret` — your client secret - `refresh_token` or `authorization_code`

Step 3: Refresh your token

Access tokens expire after 1 hour. Your app should store the refresh_token securely and use it to obtain a new access_token when needed. See Refresh Token for details.