> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sideshift.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Company automations

> Register a company-authorized OAuth machine client and request short-lived access tokens.

For most internal scripts, a [Platform API key](/self-use) is the shortest setup. Use an OAuth
`client_credentials` automation when your backend needs short-lived bearer tokens. It has no
redirect URI, human consent step, or refresh token.

## Register in the company dashboard

1. Select the company and open **Settings → Platform API & MCP → Clients**. In the new design
   system, open **Settings → API & MCP → Clients**.
2. Create a **My company automation** client.
3. Enter a name and explicitly select the permissions it needs, such as `campaigns:read`.
   You need credential-management access and permission to grant every selected scope.
4. Save the client ID and one-time client secret in your server's secret store.

<Warning>
  Public Dynamic Client Registration (`POST /register`) does not authorize company machine
  access. Human OAuth consent also does not authorize `client_credentials`. Create the machine
  app through the dashboard; an unapproved client receives `unauthorized_client`.
</Warning>

## Request a token

Set `SIDESHIFT_CLIENT_ID` and `SIDESHIFT_CLIENT_SECRET` from the dashboard, then send:

```bash theme={"system"}
curl -sS "https://app.sideshift.app/api/oauth/v1/token" \
  --user "$SIDESHIFT_CLIENT_ID:$SIDESHIFT_CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=campaigns:read"
```

The response contains `access_token`, `token_type`, `expires_in`, and `scope`. Use the returned
scope set, which can be narrower than the requested set if the creator's access changed.
Store the token privately as `SIDESHIFT_ACCESS_TOKEN` and call:

```bash theme={"system"}
curl -sS "https://app.sideshift.app/api/oauth/v1/campaigns?limit=25" \
  -H "Authorization: Bearer $SIDESHIFT_ACCESS_TOKEN"
```

Request another token when it expires. Do not attempt a refresh-token grant for this flow.
Never put the client secret in browser code, mobile apps, source control, or logs.

## Access and lifecycle

New dashboard automations stay bound to the selected company and the creator's current
permissions. Both token issuance and resource requests enforce that limit. Removing the
creator's membership stops the automation; register a replacement under an authorized owner
before deprovisioning its creator when continuity is needed.

Editing scopes cannot grant beyond the manager's own access. A manager cannot take over or
rotate the secret of a broader app. Scope reductions narrow already-issued tokens; scope
increases require a new token. Deleting or suspending the app invalidates future resource
requests using its tokens. Secret rotation prevents future authentication with the old secret;
it does not by itself revoke already-issued access tokens.

Machine tokens do not carry child delegation. For one credential across agency children, use
[a delegated Platform key or human OAuth connection](/platform/agency-access).

Existing company-bound machine apps created before creator-bound authorization keep their
company binding. No re-registration is required just to retain that existing setup.