---
title: "OAuth 2.0 Credentials"
slug: "oauth-20-credentials"
description: "Insider One's OAuth 2.0 Credentials guide (beta): generate Client ID/Secret for WhatsApp APIs, obtain Bearer tokens via Insider Gateway, and handle error codes."
updated: 2026-08-17T15:12:55Z
published: 2026-08-17T15:12:55Z
canonical: "academy.insiderone.com/oauth-20-credentials"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://academy.insiderone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth 2.0 Credentials

> [!NOTE]
> This feature is released in beta. If you want to get an early access, you need to [create a support ticket](https://academy.insiderone.com/docs/create-support-tickets).

Insider One provides a set of APIs to support various business use cases. You can use one or more of these APIs depending on your integration needs.

In addition to [API key authentication](/v1/docs/api-authentication-tokens), Insider One supports **OAuth 2.0** as a new authentication method. It provides a more secure and scalable authentication mechanism, enabling token-based access, fine-grained permission control, and easier credential rotation. For these reasons, OAuth 2.0 is the recommended authentication method for new integrations.

Once OAuth 2.0 is enabled and used for a specific API, API key authentication will **no longer be available** for that same API. In this case, generating a **new** API key for the same API will be **restricted**, and all requests must be authenticated using OAuth 2.0.

> [!WARNING]
> Only users with **Administrator** permission can generate tokens. If your account is not allowed to complete this operation, you can consult the Insider One team.

You can use the Oauth2.0 Credentials section to generate credentials for the following APIs:

**Transactional APIs**

- [Transactional WhatsApp messages](/v1/docs/send-transactional-whatsapp-messages-with-oauth-20)
- [Send transactional emails](https://academy.insiderone.com/docs/send-transactional-emails-api)

**WhatsApp Webhooks**

- [Update Transactional WhatsApp webhook settings](/v1/docs/update-transactional-whatsapp-webhook-settings-with-oauth-20)
- [Update Conversational WhatsApp webhook settings](/v1/docs/update-conversational-whatsapp-webhook-settings-with-oauth-20)

**Campaign Creation**

- [Conversational WhatsApp messages](/v1/docs/send-conversational-whatsapp-messages-with-oauth-20)
- [Create email campaign](https://academy.insiderone.com/docs/create-email-campaigns-api)

**Analytics API**

- [Get email campaign list](https://academy.insiderone.com/docs/get-email-campaign-list-v2)
- [Get email campaign analytics](https://academy.insiderone.com/docs/get-email-analytics-v2)
- [Get overall email analytics](https://academy.insiderone.com/docs/get-overall-email-analytics-v2)

**Template APIs**

- [Create email template](https://academy.useinsider.com/docs/content-manager-template-api#create-templates)
- [Update email template](https://academy.useinsider.com/docs/content-manager-template-api#update-templates)
- [Delete email template](https://academy.useinsider.com/docs/content-manager-template-api#delete-templates)
- [Duplicate email template](https://academy.useinsider.com/docs/content-manager-template-api#duplicate-templates)
- [Get email template](https://academy.useinsider.com/docs/content-manager-template-api#get-templates)
- [Search email templates](https://academy.useinsider.com/docs/content-manager-template-api#search-templates)
- [Create email category](https://academy.useinsider.com/docs/content-manager-template-api#create-categories)
- [Get email category](https://academy.useinsider.com/docs/content-manager-template-api#get-categories)

**Stripo API**

[Migrate Email Templates from Stripo](https://academy.insiderone.com/docs/migrate-email-templates-from-stripo)

**Mobile App APIs**

- [POST /register Live Activities](https://academy.insiderone.com/docs/post-register)
- [POST /start Live Activities](https://academy.insiderone.com/docs/post-start)
- [POST /update Live Activities](https://academy.insiderone.com/docs/post-update)
- [POST /end Live Activities](https://academy.insiderone.com/docs/post-end)
- [POST /add-users to Live Activities](https://academy.insiderone.com/docs/post-add-users)
- [POST /remove-users from Live Activities](https://academy.insiderone.com/docs/post-remove-users)
- [Get InApp details](https://academy.insiderone.com/docs/get-inapp-details)
- [Get pushes with Message Center](https://academy.insiderone.com/docs/get-pushes-with-message-center-api)

To generate an OAuth2.0 Credentials,

1. Navigate to your **username** > **Settings** > **Inone Settings** > **Integration Settings**.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/Screenshot at Jan 23 13-29-32.png)

1. Scroll to the OAuth 2.0 Credentials section to click the **Generate OAuth2.0 Credential** button.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-SJ8P1EDT.png)

If you have previously created any OAuth2.0 credentials, they will be listed in this section.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-Z6IVE8BY.png)

1. Select the API scope from the dropdown to create an OAuth2.0 credential, enter a credential name, and a token duration.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/Screenshot 2026-06-05 at 11.14.49.png)

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/Screenshot 2026-06-05 at 11.15.10.png)

> [!WARNING]
> Each user can generate **up to 10 tokens** per minute. Requests exceeding this limit will be blocked and return an error response.

1. Click the **Continue** button.
2. Authorize the trusted IP addresses to apply IP restriction, and click the **Authorize and Generate** button.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/unnamed (26)(2).png)

1. Click the **Copy** button to copy the **Client ID** and **Client Secret** before closing the prompt.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/Screenshot at Jan 23 13-51-36.png)

7. Use the **Insider Gateway Auth endpoint** to generate a Bearer token for your resource requests.

```bash
curl -X POST --location 'https://gw.useinsider.com/auth/token' \
--header 'Content-Type: application/json' \
--data '{
    "client_id": "{your_client_id}",
    "client_secret": "{your_client_secret}",
    "scopes": ["{resource_scope_you_want_to_access}"]
}'
```

8. Use the Bearer token you obtained in Step 7 to access the resource by providing a scope. Repeat the process before expiry.

> [!WARNING]
> Your request should match the **method** described in the documentation for each resource (e.g., **GET**, **POST**, **PUT**, etc.)

```bash
curl --location 'https://gw.useinsider.com/api' \
--header 'Authorization: Bearer {your_bearer_token_from_step_7}'
```

9. Now you can handle **authentication** and **authorization** **responses**. Once you generate a Bearer token and start sending requests to Insider Gateway APIs, your integration should properly handle both successful and unsuccessful responses.

Errors might occur on two main layers:

- **Authentication layer (token generation)**: Errors that happen while retrieving the OAuth2 token.
- **Gateway authorization layer (resource access):** Errors that happen while accessing APIs using the Bearer token.

The following section outlines the possible response codes and their meanings.

****Authentication API (Token retrieval)****

| Response | Meaning |
| --- | --- |
| **Rate Limited** | **Code**: “R3” **HTTP Code**: 429 **Message**: “Rate Limited” |
| **Forbidden** | **Code**: “R4” **HTTP** **Code**: 403 **Message**: “IP Restricted” |
| **Unauthorized** | **Invalid Credentials** **Code**: “R1” **HTTP** **Code**: 401 **Message**: “Invalid key or secret” **Invalid Authorization Scope** **Code**: “R2” **HTTP** **Code**: 401 **Message**: “Invalid key or secret” |

****Gateway API Responses****

| Response | Meaning |
| --- | --- |
| **Rate Limited** | **Per Minute** **Code**: “R3” **HTTP** **Code**: 429 **Message**: “Rate Limited” **Per Second** **Code**: “R7” **HTTP** **Code**: 429 **Message**: “Rate Limited” |
| **Forbidden** | **Code**: “R4” **HTTP** **Code**: 403 **Message**: “IP Restricted” |
| **Unauthorized** | **Invalid Token** **Code**: “R1” **HTTP** **Code**: 401 **Message**: “Invalid Token” **Expired Token** **Code**: “R5” **HTTP** **Code**: 401 **Message**: “Invalid Token” **Invalid Scope** **Code**: “R6” **HTTP** **Code**: 401 **Message**: “Unauthorized Request” |

**Response format**

```json
{
	"code": "",
	"message": ""
}
```

**Custom response code mapping**

```plaintext
R1 => Invalid Crendentials
R2 => Invalid Authentication Scope (while generating token)
R3 => Rate Limited
R4 => IP Restricted
R5 => Token Expired
R6 => Invalid Authorization Scope (while sending request)
R7 => Burst Limited
```

10. To delete the previously created OAuth2.0 credentials, click the **Delete** button against the key you want to delete.

![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/unnamed (27)(2).png)

11. To edit the previously created OAuth2.0 credentials, click the **Edit** button against the key you want to edit. You can change only the **API scope** and **IP Address Authorization**.![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-NPMCJZO8.png)