How to authenticate with the Daylite API using OAuth 2.0 or a personal token.
The Daylite API uses OAuth 2.0 for authentication. If you're just getting
started or building something for your own account, the quickest path is a
personal token — no app registration required.
If you're building an integration that other Daylite users will authorize
through your app, you'll need to register an OAuth application. Follow the
steps below to get set up.
Getting Started with OAuth
Step 1: Register your application
To register a new application, fill out the App Registration form. We will need the following information from you:
| Field | Description |
|---|---|
| Application name | Name of your application |
| Application identifier | A reverse DNS style identifier, like com.mycompany.mygreatdayliteapp |
| Organization | The name of the organization affiliated with your app |
| Support email | An email address users of your app can contact for support |
| Requested Scopes | List of requested OAuth scopes. See the OAuth Scopes table below |
| Redirect URLs | URLs where the user will be redirected after authorization is complete |
OAuth Scopes
daylite:read | Read access to all Daylite data |
daylite:write | Write access to all Daylite data |
Step 2: Authenticate the user
The authentication is an OAuth 2.0 flow — the user signs in with their Marketcircle credentials, authorizes your app to access Daylite, and your app receives a code it can exchange for an access token.
See the OAuth 2.0 RFC section 1.2 to learn more about the authentication flow.
OAuth 2.0 Endpoints
| Endpoint | Description | Required Parameters |
|---|---|---|
| https://www.marketcircle.com/account/oauth/authorize | Page where the user authorizes your application to access Daylite data | Query Parameters - client_id — the identifier of your application- redirect_uri — URL where the user will be redirected after authorization- scopes (optional) — must be a subset of the scopes requested during registration |
| https://www.marketcircle.com/account/oauth/token | Exchange an authorization_code or refresh_token for an access_token | x-www-form-urlencoded body in POST with- client_secret — your client secret- refresh_token or authorization_code |
Step 3: Refresh your token
Access tokens expire after 1 hour. Your app should store the refresh_token securely and use it to obtain a new access_token when needed. See Refresh Token for details.