API access to Mesh uses the OAuth2 client credentials flow. Users can generate a set of credentials (consisting of an access key and secret) in the UI (Settings > Access Management > API Credentials). The lifespan, permissions and optional expiry date of the credentials can all be configured by the user at the time of creation.

These credentials can then be used to generate an access token by calling this endpoint. This token must then be sent in headers when making authenticated API calls.

"Authorization":"Bearer {access_token}"

Each token has an expiry of 24 hours (86,400 seconds). This is not configurable. Once a token expires, any requests made using it will fail — there is no refresh mechanism, so a new token must be generated the same way as before. When client credentials expire or are revoked by the user, they can no longer be used to generate access tokens.