Savee Authentication

generated: '2026-09-03'
method: searched
source: openapi/savee-boards-api-openapi.yml, openapi/savee-saves-api-openapi.yml, openapi/savee-search-api-openapi.yml,
  openapi/savee-user-api-openapi.yml + https://docs.savee.com/api/authentication + https://docs.savee.com/api/oauth
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - authorizationCode
schemes:
- name: BearerAuth
  type: http
  scheme: bearer
  bearerFormat: sv_live_…
  description: '**Personal access token** (`sv_live_…`) — represents you and carries every scope, so no
    scope is required for this call. Best for your own scripts and internal tools. Generate one at https://savee.com/developers/.'
  sources:
  - openapi/savee-boards-api-openapi.yml
  - openapi/savee-saves-api-openapi.yml
  - openapi/savee-search-api-openapi.yml
  - openapi/savee-user-api-openapi.yml
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://savee.com/oauth/authorize/
    tokenUrl: https://savee.com/api/oauth/token/
    scopes: 4
  description: |-
    **OAuth access token** (`sv_at_…`) — obtained on one of your users’ behalf and limited to the scopes they approved. Use this when you’re building a product other people sign into with Savee. See https://docs.savee.com/api/oauth.

    Missing the scope below returns `403` with a `WWW-Authenticate: Bearer error="insufficient_scope"` header naming it.
  sources:
  - openapi/savee-boards-api-openapi.yml
  - openapi/savee-saves-api-openapi.yml
  - openapi/savee-search-api-openapi.yml
  - openapi/savee-user-api-openapi.yml
docs: https://docs.savee.com/api/authentication
details:
  personal_access_token:
    format: sv_live_ prefix followed by 24 characters
    issuance: Savee → Settings → Developers → API Access; shown once, SHA-256 hash stored
    concurrency: At most one active token per user; generating a new one revokes the previous
    expiry: None — revoked by regenerate/revoke, or rejected with 402 while the subscription is lapsed
    scope: Carries every scope implicitly
  oauth:
    access_token: sv_at_ prefix; 1-hour lifetime (expires_in 3600)
    refresh_token: sv_rt_ prefix; 30-day lifetime, rotates on every use; replaying a used refresh token
      revokes the entire chain
    client_type: Confidential — client secret required at the token endpoint (client_secret_basic or client_secret_post)
    pkce: S256 required; plain rejected
    resource_indicator: resource=https://api.savee.com required on authorization and token requests (RFC
      8707)
    registration: Invite-only while partner integrations are onboarded one at a time (hey@savee.com);
      up to 6 apps and 10 redirect URLs per account, exact-match https redirects (http only on localhost)
    metadata: https://savee.com/.well-known/oauth-authorization-server (RFC 8414, probed 200 on 2026-09-03)
    revocation: https://savee.com/api/oauth/revoke/ (RFC 7009)
  subscription_gate: Both token types require an active paid Savee subscription, checked on every request
    — 402 PAYMENT_REQUIRED when lapsed
  cors: 'Access-Control-Allow-Origin: * is sent, with explicit guidance never to ship tokens to browsers'