Xiaoman Authentication

generated: '2026-07-21'
method: searched
source: https://open.xiaoman.cn/api-3473041 and npm @okki-global/okki-go skill/references/api-reference.md
docs:
  - https://open.xiaoman.cn/api-3473041
  - https://open.xiaoman.cn/doc-338276
summary:
  types: [oauth2, apiKey]
  oauth2_flows: [password, clientCredentials]
  api_key_in: [header]
schemes:
  - name: XiaomanOAuth2
    api: Xiaoman OKKI CRM Open API
    type: oauth2
    description: >-
      OAuth2 token issued by POST /v1/oauth2/access_token on
      https://api-sandbox.xiaoman.cn. Supports grant_type password (username =
      Xiaoman login email, password SHA-256 hashed) and client_credentials.
      client_id and client_secret come from the OKKI CRM admin console
      (企业管理 → 外部对接 → API对接). Tokens are Bearer, valid 8 hours
      (expires_in 28800); password grant also returns a refresh_token
      (refresh endpoint documented separately). client_credentials responses
      carry no expires_in/refresh_token — re-request before expiry. The scope
      parameter is a space-separated list of module scopes (see
      scopes/xiaoman-scopes.yml); calls outside granted scopes fail with
      "no permission <module> scopes".
    flows:
      - flow: password
        tokenUrl: https://api-sandbox.xiaoman.cn/v1/oauth2/access_token
      - flow: clientCredentials
        tokenUrl: https://api-sandbox.xiaoman.cn/v1/oauth2/access_token
    token_lifetime_seconds: 28800
    header: Authorization
  - name: OkkiGoApiKey
    api: OKKI Go API
    type: apiKey
    in: header
    parameter: Authorization
    description: >-
      API key auth for https://go.okki.ai — header form
      "Authorization: ApiKey sk-...". Keys are issued at https://go.okki.ai
      after registration; the OKKI Go Agent Skill caches the key in
      ~/.config/okki-go/credentials.json (mode 0600) via its okki-auth.js
      helper. All authenticated endpoints share a 60 requests/minute rate
      limit.