Authentication and permissions
The Public API uses OAuth 2.0 client credentials with opaque bearer tokens. The client_secret is shown once; Klik Račun stores its scrypt hash. Access tokens are stored as SHA-256 digests.
Credential exchange
Authenticate the client with HTTP Basic. Credentials in JSON or form fields are not accepted.
POST /oauth2/token HTTP/1.1
Authorization: Basic base64(client_id:client_secret)
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&scope=invoices%3Aread%20invoices%3Adraft
/public/v1/oauth2/token is an equivalent, versioned alias.
Permissions
| Permission | Allows |
|---|---|
invoices:read | Read outgoing invoices, UBL, status, and operations |
invoices:draft | Create and update drafts |
invoices:issue | Validate and issue drafts |
invoices:reverse | Fully reverse issued invoices |
invoices:correct | Preview and confirm guarded corrections |
advances:write | Reserve and release advances |
payments:read | Read payment evidence |
payments:write | Record and void payment evidence |
incoming:read | Read the organization's incoming invoices |
incoming:respond | Approve or reject incoming invoices |
events:read | Open the client- and OIB-bound operation event stream |
Requested permissions must be a subset of those assigned to the client. Prefer several narrowly privileged production clients over one credential with every permission.
Organization binding and revocation
Klik Račun verifies the credential-bound OIB for raw UBL ownership, outgoing resources, incoming customer ownership, correction plans, operations, and events. An OIB mismatch returns 403; a resource owned by another organization appears as 404 to avoid disclosing its existence.
Rate-limit headers are returned on protected calls. Secret rotation or client deactivation immediately revokes active tokens.