Authentication

The Orchestration API authenticates every request with an OAuth 2.0 access token obtained through the Client Credentials flow. To get started, reach out to MetaRouter to obtain a Client ID and Secret for your organization.

Request an Access Token

Request a token directly from the MetaRouter authorization server, specifying the Orchestration API audience:

curl --request POST \
  --url https://metarouter.us.auth0.com/oauth/token \
  --header 'Content-Type: application/json' \
  --data '{
    "grant_type": "client_credentials",
    "client_id": "your_client_id",
    "client_secret": "your_client_secret",
    "audience": "https://ion.metarouter.io"
  }'

The response contains an access_token valid for 24 hours:

{
  "access_token": "eyJhbGciOi...",
  "expires_in": 86400,
  "token_type": "Bearer"
}

Use the Token

Pass the token in the Authorization header on every request:

curl --request GET \
  --url 'https://ion-api.mr-ui-prod1.gcp-us-central1.metarouter.io/api/v1/audit-logs?page=1&perPage=20' \
  --header 'Authorization: Bearer <your_access_token>'

No other headers are required.

Notes

Tokens are scoped to a single audience. A token minted for the Control API (https://control.metarouter.io) is not valid for the Orchestration API, and vice versa — request a separate token for each API you intend to call, even when using the same Client ID and Secret.
Requests with a missing, expired, or wrong-audience token receive a 401 response.
Mint a new token when the current one expires rather than requesting one per call; tokens may be reused freely within their 24-hour lifetime.