> ## Documentation Index
> Fetch the complete documentation index at: https://mwithheart.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate and get an access token

The Dribbble API uses *OAuth 2.0* to securely authenticate applications.
This guide walks you through how to register your app, authorize users, and obtain your access token.

## Overview

OAuth 2.0 is an industry-standard protocol for secure delegated access.\
Instead of sharing passwords, users grant your app permission to act on their behalf using **tokens**.

Here’s how the Dribbble OAuth flow works:

1. Register your app to get a `Client ID` and `Client Secret`.
2. Direct users to the *authorization URL*.
3. Receive a *code* when they approve your app.
4. Exchange that code for an *access token*.
5. Use the token to make authenticated requests.

#### Step 1: Register your application

1. Create an account on the Dribble home page or login.
2. Visit the [Applications page](https://dribbble.com/account/applications/new).
3. Select Applications from the side menu
4. Click **Register a New Application**.
5. Enter your app details and **callback URL**.
6. Click **Create Your Application**.
7. Your **Client ID** and **Client Secret** show up at the bottom of the page. Copy them and keep them safe.

<Tip>
  Your callback URL is the endpoint where Dribbble redirects users after they approve access.\
  Example: `https://myportfolio.com/auth/dribbble/callback`
</Tip>

#### Step 2: Request user authorization

1. Redirect users to the following URL:

   ```
   https://dribbble.com/oauth/authorize?client_id=YOUR_CLIENT_ID
   ```

2. Once the user approves, Dribbble redirects them to your callback URL with a `code`:

   ```
   https://your-callback-url?code=9892aebf...
   ```

#### Step 3: Exchange the code for an access token

Use your **Client ID**, **Client Secret**, and **Authorization Code** to request a token.

```bash theme={null}
curl -X POST "https://dribbble.com/oauth/token" \
    -d client_id=YOUR_CLIENT_ID \
    -d client_secret=YOUR_CLIENT_SECRET \
    -d code=AUTHORIZATION_CODE \
    -d redirect_uri=YOUR_CALLBACK_URL
```

You’ll receive a JSON response like:

```json theme={null}
{
"access_token": "abc123...",
"token_type": "bearer"
}
```

<Note>
  Store your access token securely. Do not expose it publicly (for example, in frontend code or GitHub repos).
</Note>

#### Step 4: Use the access token  - Fix the code here

Include your token in the query parameter:

```
Authorization: Bearer YOUR_ACCESS_TOKEN
```

Example:

```bash theme={null}
curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
https://api.dribbble.com/v2/user
```

Response:

```json theme={null}
{
"id": 123,
"name": "Jane Doe",
"username": "janedesigns"
}
```

### Handle Common Errors

| Error                   | Description                                 | How to fix                                                                                                                                   |
| ----------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `invalid_client`        | Incorrect Client ID or Secret               | Double check the client\_id and client\_secret to make sure they are correct                                                                 |
| `invalid_grant`         | Code expired or reused                      | Request a new authorization code                                                                                                             |
| `unauthorized`          | Token missing or invalid                    | Include the `Authorization` header                                                                                                           |
| `400 Bad Request`       | Missing required parameter                  | Verify your query parameters                                                                                                                 |
| `Redirect URI Mismatch` | Redirect URI doesn't match the previous one | Provide a redirect\_uri that matches what you registered or leave out this parameter to use the default one registered with your application |

### Token Management Tips

* **Tokens typically don’t expire quickly**, but can be revoked anytime via your Dribbble account.
* Always **use HTTPS** to keep tokens secure in transit.

### Next Steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="square-code" href="./quickstart">
    Try your first API request.
  </Card>
</CardGroup>