Mint unattended access tokens for an organization that already granted consent, and revoke a grant when the integration ends.
Once a grant exists, request tokens for that organization without involving the user. Client Credentials never creates a grant — run Authorization Code + PKCE first for each new organization.
There are no refresh tokens. A Client Credentials token can be re-requested at any time, so design ongoing integrations around this grant rather than Authorization Code.
Optional. Omit to receive the grant’s full set. If supplied it must be a subset of the granted scopes, or you get invalid_scope.
Renewal is simply another request. Cache the token for its hour rather than minting one per API call — the token endpoint is rate limited per client.
unauthorized_client — what it means here
Your client is authenticated but does not have client_credentials in its allowed grant types. Ask Soundlink to add it.
invalid_grant — what it means here
One of: no grant exists for this client and organization; the grant was revoked; or THIRD_PARTY_INTEGRATIONS_ENABLED is off for that organization. Run the consent flow for the organization first — Client Credentials never creates a grant.
Disconnect an organization by revoking the grant. Authenticate with your client credentials and identify the grant by grant_id (available as a token claim).
Returns 200 with an empty body. The operation is idempotent — revoking an unknown or already-revoked grant also returns 200, so retries are safe.
Existing access tokens survive revocation for up to one hour.Revocation immediately prevents new tokens from being issued for that grant. It does not invalidate tokens already minted: access tokens are stateless and are validated without a per-request grant lookup, so a token issued moments before revocation remains accepted until its exp — at most 3600 seconds later.If access must stop instantly, enforce it on your side as well: discard your cached tokens at revocation time and stop issuing requests.
After revoking, delete the organization id and grant id from your store. Re-connecting requires the full consent flow again.
