SnackMagic · Authentication Profile

Snackmagic Authentication

Authentication

SnackMagic secures its APIs with http, apiKey, and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials, authorizationCode, authorizationCodePKCE, and refreshToken flow(s).

CompanyConsumerGiftingRewardsSwagSnacksE-CommerceFulfillment
Methods: http, apiKey, oauth2 Schemes: 2 OAuth flows: clientCredentials, authorizationCode, authorizationCodePKCE, refreshToken API key in: header

Security Schemes

Token http
scheme: bearer
api_key apiKey
· in: header (api_key)

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-21'
method: searched
source: openapi/snackmagic-stadium-openapi.yml
docs: https://api.bystadium.com/api/v2/docs
summary:
  types:
  - http
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  - authorizationCodePKCE
  - refreshToken
notes: >-
  The Stadium API (SnackMagic is a Stadium brand) authorizes most endpoints with a
  bearer JWT access token (the `Token` HTTP bearer scheme). Access tokens are obtained
  through OAuth2 flows documented in the API description: Client Credentials (global
  organizer accounts), Authorization Code (act on behalf of a Stadium user via
  /oauth/authorize -> /oauth/token_by_code), Authorization Code with PKCE (native/SPA
  clients), and refresh-token exchange. The webhook automation endpoints
  (/automations/orders, /automations/order_status) instead authenticate with a static
  `api_key` request header tied to a configured automation. The OpenAPI only formally
  declares the `Token` http-bearer scheme; the OAuth2 flows and the automation api_key
  header are documented in prose and in the operation parameters, and are captured here.
schemes:
- name: Token
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: most endpoints (users, stores, orders, send_points)
  sources:
  - openapi/snackmagic-stadium-openapi.yml
- name: api_key
  type: apiKey
  in: header
  parameter: api_key
  applies_to: webhook automation endpoints (/automations/orders, /automations/order_status)
  description: API key of the configured webhook automation.
  sources:
  - openapi/snackmagic-stadium-openapi.yml
oauth2:
  authorize_url: https://api.bystadium.com/api/v2/oauth/authorize
  token_url: https://api.bystadium.com/api/v2/oauth/token
  token_by_code_url: https://api.bystadium.com/api/v2/oauth/token_by_code
  refresh_url: https://api.bystadium.com/api/v2/oauth/token_by_refresh_token
  validate_url: https://api.bystadium.com/api/v2/oauth/validate
  pkce: true
  scopes: []