Authentication
Integrations exchange a registered client ID and client secret for a short-lived bearer token. Credentials belong in server-side secret storage and must never be embedded in a public page or client bundle.
Public API
Programmatic access with explicit credentials and product boundaries.
The Wizzo Public API is an authenticated integration surface. The public overview is crawlable; token issuance, credentials, account data, and the API playground remain on the product host.
Safety controls
- OAuth client-credentials token issuance with bounded token lifetime
- Hashed client secrets and explicit scopes
- Per-minute rate limits with configured floors and ceilings
- Signed webhook delivery when a webhook destination is configured
Token request shape
Use a server-to-server form request.
POST https://app.gowizzo.io/api/public/oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRETThe example uses placeholders only. Never paste a live credential into analytics, support messages, browser screenshots, or public source control.
Ready to move?
Start in Wizzo, then scope an integration.
Create an account to explore the product. API access and scopes should be chosen for a concrete server-side workflow.