Frequently asked questions
What is the difference between /auth/token and /oauth2/token?
None. Both paths accept the same form and return the same response. Use whichever you prefer.
Should I use local login or an OAuth token?
For system-to-system integrations, use the password grant: it returns a Bearer token in the JSON. Local login reproduces the user login, with MFA, and delivers the session in a cookie.
How long is the token valid?
For the number of seconds given in expires_in. The value depends on the environment configuration.
Does the scope field indicate the token permissions?
No. scope contains the URI of the API configured in the environment. Permissions are defined by the user rules in the environment.
Does the API accept JSON in the request body?
No. The endpoints accept application/x-www-form-urlencoded, multipart/form-data, or application/octet-stream. Responses are JSON, except for downloads.
Can I build the download URL from the file id?
No. Always use the linkURL returned by the listing. It contains signed parameters that authorize the download.
Does the recipient of a shared link need a user and password?
No. The secure link authorizes the download; the recipient may only need the PIN. See Shared links.
How do I check that the file arrived intact?
Provide the hash when you send the file (h field or X-STCPDIRECTLINK-HASH header) and compare the length in the response with the file size. See Send files.
Where can I find the OpenAPI specification?
In OpenAPI specification, in Portuguese, English, and Spanish.