Oto Global Authentication

generated: '2026-07-20'
method: searched
source: https://apis.tryoto.com/ (OTO API V2 Authorization docs + Postman collection)
docs: https://help.tryoto.com/en/support/solutions/articles/150000178771
summary:
  types: [http]
  http_schemes: [bearer]
  token_format: JWT
  flow: refresh-token
  api_key_in: []
  oauth2_flows: []
description: >-
  OTO uses a two-token bearer scheme. A long-lived refresh_token is issued from the OTO
  dashboard (Settings -> API Integrations -> Connect). The refresh_token is exchanged at
  POST /rest/v2/refreshToken for a short-lived access_token (JWT, expires_in 3600s /
  1 hour). All other endpoints are called with header Authorization: Bearer <access_token>.
  A small number of endpoints (refreshToken, healthCheck, register) require no auth.
schemes:
  - name: bearerAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    applies_to: all endpoints except refreshToken, healthCheck, register
    sources: [openapi/oto-global-openapi.yml]
token_endpoint:
  operation: refreshToken
  method: POST
  url: https://api.tryoto.com/rest/v2/refreshToken
  request: '{ "refresh_token": "<your refresh token>" }'
  response_fields: [access_token, refresh_token, token_type (Bearer), expires_in (3600), success]
  obtain_refresh_token: OTO dashboard -> Settings -> API Integrations -> Connect
notes:
  - access_token lifetime is 1 hour; renew via refreshToken before expiry.
  - Tracking (public branded tracking URL) can be consumed without authorization.