Authentication

Every request carries Authorization: Bearer <token>. Two kinds of token work, and they behave identically once sent:

• API keys (nook_sk_…) — for your own account. Made in Settings, usable immediately.
• OAuth access tokens (nook_at_…) — for apps acting on a customer’s account.

Reaching a sub-account

What the interface calls a sub-account, the API also calls a sub-account: sub_account_id. One word for one thing, so there is no translation table to carry in your head.

A token is issued for an agency or for a single sub-account. An agency token reaches its sub-accounts by passing ?sub_account_id=…; a sub-account token is already scoped and does not need it. There is no second token type and no exchange step.

Scopes

Resource and verb, in plain words: calendars:read, calendars:write, contacts:read, contacts:write, conversations:read, conversations:write, knowledge:read, knowledge:write, opportunities:read, opportunities:write, tasks:read, tasks:write, workflows:read, workflows:write. A :write scope implies :read on the same resource, and never on any other.