Authentication

When your access opens, Native gives your team one machine-to-machine application, with a client_id and a client_secret. The same pair signs you in to the Norn API and the Native API. Your backend trades it for a short-lived access token and sends that token with every call.

Keep the secret on your server. Never put it in a browser, a mobile app or a repository. If it leaks, write to hei@native.no and we will replace it.

Use the OAuth client-credentials grant. Name the API you want a token for in audience:

curl -X POST https://auth.native.no/oauth/token \
  -d grant_type=client_credentials \
  -d client_id="$NATIVE_CLIENT_ID" \
  -d client_secret="$NATIVE_CLIENT_SECRET" \
  -d audience=https://mcp.native.no/mcp \
  -d scope="mcp:read mcp:write"

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "mcp:read mcp:write"
}

• The audience must match the API exactly. A token for one API does not work on the other: fetch one token per API you call.
• A token lasts at most one hour, and the Native API refuses a token that would last longer. Cache it and fetch a new one shortly before expires_in runs out.
• Every Native API tool needs mcp:read. Tools that change something also need mcp:write.

When your access opens, you can also ask for credentials on Native’s development environment, for trying calls without touching real customers. They use the same flow, with a token endpoint and an MCP address of their own that we send with them.

Send the token as a bearer token on every request:

Authorization: Bearer <ACCESS_TOKEN>

The Native API is MCP over Streamable HTTP, so the token goes on the transport when you create the MCP client. Make a new client when you fetch a new token. The Native API overview shows the client.