Kudobuzz Authentication

generated: '2026-07-19'
method: searched
source: https://docs.kudobuzz.com/auth.md
docs: https://docs.kudobuzz.com/#/auth
notes: >-
  Kudobuzz does not publish an OpenAPI definition, so this profile is taken
  verbatim from the published authentication page of the Kudobuzz API docs
  rather than derived from securitySchemes. Kudobuzz uses a two-credential
  model split by execution context: a secret account token for server-side
  calls and a public client id for browser-side calls. There is no OAuth 2.0
  authorization-code flow and therefore no scope surface (scopes/ is
  intentionally absent for this provider).
access_model:
  gated: true
  how_to_get_access: >-
    API access is granted per account. Merchants on the Buffet plan have full
    API access; app developers building integrations get API access for free.
    Access is requested by emailing the Kudobuzz team, which then issues
    credentials.
  request_url: https://kudobuzz.com/developer-api
  eligibility:
    - Kudobuzz merchants on the Buffet plan
    - Third-party app developers building Kudobuzz integrations (free)
credentials_location: https://dashboard.kudobuzz.com/settings
schemes:
  - id: kudobuzz_token
    type: apiKey
    name: accessToken
    context: server
    secret: true
    description: >-
      The Kudobuzz account token. Used for server-side calls. Passed to the
      official client wrapper as `accessToken`. Must never be exposed in
      browser code.
    source: https://docs.kudobuzz.com/auth.md
  - id: kudobuzz_client_id
    type: apiKey
    name: clientId
    context: browser
    secret: false
    description: >-
      The Kudobuzz client id. Used for client-side / browser calls where a
      secret token cannot be safely held. Passed to the official client
      wrapper as `clientId`.
    source: https://docs.kudobuzz.com/auth.md
usage_example:
  language: javascript
  package: "@kudobuzz/kbclient"
  code: |
    import makeClient from '@kudobuzz/kbclient'
    const client = makeClient({
        accessToken: 'Your access token here',
        clientId: 'Your client ID here'
    })
transport:
  https_required: true
  evidence: >-
    The Kudobuzz API standards require HTTPS/TLS for all API access
    (https://github.com/kudobuzz/api-standards).
internal_standard:
  note: >-
    Kudobuzz's own published API design standard recommends OAuth 2.0 bearer
    tokens for its services. The public Developer API as documented today ships
    the token + client id model above, not an OAuth authorization server.
  source: https://github.com/kudobuzz/api-standards#security