Authentication

Keys and tokens

The API uses OAuth 2.0 client credentials. Exchange a key for an access token, then send the token with every call.

Keys

Create keys in the developer console. A key is a client ID and a secret; the secret is shown once and stored only as a hash.

Test keys

ls_test_…: only for your sandbox ID; nothing is published. See Test mode.

Live keys

ls_live_…: publish, only for agencies that approved your connection.

Per account

Up to 5 active keys per environment. Give each a label so you know where it's used.

Access tokens

Send the client ID and secret with HTTP Basic auth (or as client_id and client_secret in the form body). The token lasts an hour: reuse it rather than asking for one per call.

POST https://liststream.com.au/oauth/token
Authorization: Basic base64(<client_id>:<client_secret>)
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

200 OK
{ "access_token": "eyJ...", "token_type": "Bearer", "expires_in": 3600 }

Then send Authorization: Bearer <access_token> on every API call. Test tokens carry the scopes listings:write listings:read; live tokens also carry connections.

Revoking

Revoke a key in the console. It stops working straight away, including tokens already issued from it (401).

Errors

The token endpoint answers in the OAuth format, { error, error_description }: invalid_client (401) for an unknown, wrong or revoked key, unsupported_grant_type (400), and slow_down (429) if you ask for tokens too often.