API
Language
Ask for a seat

Closed beta. Nothing here is callable yet. These docs describe the day-one contract, and names marked proposed may change before the beta opens. Ask for a seat

Docs · Reference

Access tokens

Exchange client credentials for the short-lived token every other call needs.

Exchange client credentials for an access token

POST/v1/oauth/token

Send your client_id and client_secret with HTTP Basic (recommended) or as form fields, with grant_type set to client_credentials. The token carries the scopes fixed on the client; the scope field is reserved and ignored. Any problem with the client returns the same invalid_client error. Responses are never cached.

Authentication

HTTP Basic with your client_id and client_secret, or the same two values as form fields.

Request body · application/x-www-form-urlencoded

grant_typestringrequired

Always client_credentials

One of client_credentials

scopestring

Reserved and ignored: the token carries the client's fixed scopes

client_idstring

Only when you don't use HTTP Basic

client_secretstring

Only when you don't use HTTP Basic

Response · TokenResponse

access_tokenstringrequired

Opaque bearer token. Not a JWT: don't parse it

token_typestringrequired

Always Bearer

One of Bearer

expires_inintegerrequired

Seconds until the token expires

scopestringrequired

The scopes fixed on the client

Responses

  • 200Token issued
  • 400The request is malformed or the grant type isn't client_credentials
  • 401invalid_client: the client couldn't be authenticated
  • 413The body is over the size limit. Not retryable
  • 415The operation doesn't accept the body's content type. Not retryable
  • 429Too many requests. Wait for Retry-After
  • 500Something failed unexpectedly on Novo's side. Not retryable: quote request_id to support
  • 503Something the answer depends on is unavailable. Retry after Retry-After
Request
curl -X POST "https://$NOVO_API_HOST/v1/oauth/token" \
  -u "nvo_client_example:$CLIENT_SECRET" \
  -d "grant_type=client_credentials"
Response · 200
{
  "access_token": "nvo_at_example_opaque_token",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "accounts:read transactions:read"
}

Planned for access tokens

  • Lock a key to the tools and machines you’ve approvedNeeds your approval

Not available yet, and no endpoints are published for it. They’ll appear here once the contract defines them. Anything marked “needs your approval” waits for the account owner to approve it on their phone, every time. Tell us what you need first when you ask for a seat.