Authentication
OAuth 2.0 with PKCE and dynamic client registration.
Travelyfe uses OAuth 2.0 authorization code flow with PKCE (S256 only). Discovery documents are at:
https://api.travelyfe.com/.well-known/oauth-authorization-serverhttps://api.travelyfe.com/.well-known/oauth-protected-resource
Scopes
| Scope | Allows |
|---|---|
itineraries:read | Reading itineraries and searching Explore |
itineraries:write | Creating and changing itineraries |
documents:read | Seeing document names and kinds (never contents) |
documents:write | Adding, renaming and deleting documents |
The Flow
Register your client with POST /oauth/register, sending your redirect_uris. You get a client_id (and a client_secret if you ask for client_secret_post).
Authorize: send the traveller to GET /oauth/authorize with client_id, redirect_uri, response_type=code, scope, state and a code_challenge. They sign in to Travelyfe and approve.
Exchange the returned code with POST /oauth/token (grant_type=authorization_code, code_verifier, redirect_uri, client_id).
Call the API with Authorization: Bearer <access_token>. Access tokens last one hour; use the refresh_token (valid 90 days) with grant_type=refresh_token to get a new one.
curl -X POST https://api.travelyfe.com/oauth/token \
-d grant_type=authorization_code \
-d code=$CODE -d code_verifier=$VERIFIER \
-d redirect_uri=https://example.com/callback \
-d client_id=$CLIENT_IDRevoke a token with POST /oauth/revoke. Travellers can also disconnect apps from Settings → Connected Apps at travelyfe.com.