BMM CONNECT DOCUMENTATION

OAuth authentication

Credentials and permissions for existing integrations.

OAuth compatibility: credentials and permissions

Value	Meaning	Where it belongs
Application ID (`client_id`)	Identifies your approved application	Server configuration; public in authorization URLs
API key (`client_secret`)	Authenticates your application	Server secret storage only
Creator access token	Represents this creator’s approved connection and scopes	Server storage only
Refresh token	Renews access, subject to session validity and revocation	Server storage only; replace after refresh
`support_url`	Public BMM profile URL with attribution	Safe to render as a public support button

Authenticated profile, earnings and disconnect requests require all three headers: Authorization: Bearer ACCESS_TOKEN, X-BMM-Client-ID, and X-BMM-API-Key. The key authenticates the partner; the token represents the creator’s authorization. This is an intentional requirement of BMM Connect. Browser code must call your own server rather than these endpoints directly.

Scopes are profile:read, optional support:read, and offline_access. The authorization wrapper requests these; BMM consent determines which are actually granted. An approved developer application does not grant access to any creator by itself. Rotating your API key immediately invalidates the previous key; update your server configuration. Website/callback changes require admin review.

Existing OAuth endpoints

New integrations should use hosted connections. The token-free hosted protocol does not change existing OAuth grants.

← All endpoints