Connect an External buyer server

Use a separate External OAuth2 client for an eligible buyer account.

Before you start

  • Account owner; active External account; approved commercial registration.

Where to go

External → API Access

Audience

External account owners with approved commercial registration.

Permissions

  • Use your current account role; a Help link does not grant permission.

Workflow

  1. Open External → API Access as the account owner. Read the eligibility result: the account must be active with approved commercial registration (CR).
  2. Create a client with only the required External scopes. Copy its reveal-once secret into your server secret store and close the reveal.
  3. Exchange client_credentials at POST /v1/oauth/token with the External client ID, secret and assigned scopes. Start read-only catalog access with catalog:read.
  4. Use the returned access_token with GET /v1/external-marketplace/providers. Honor expires_in (currently 900 seconds); obtain a new token when required. No refresh token or browser redirect is supplied.
  5. External scopes are catalog:read, requests:create, requests:read, quotes:read, quotes:select, payments:read, jobs:read, completion:approve and disputes:create. Vendor scopes and vendor routes do not apply.
  6. Owner, requester and finance roles retain their existing buyer responsibilities. API Access management requires the owner; a buyer role does not become a vendor administrator.
  7. For planned rotation, deploy and verify the replacement before revoking the old client. If exposed, revoke promptly, replace it and inspect sanitized server logs.

Expected outcome

Read the current saved state in the workspace after the permitted action; Help does not perform or verify the action.

Troubleshooting

invalid_client, invalid_scope or 403
Check the active client, exact External scope, account eligibility and owner access. A revoked client or changed CR status requires current server authorization.

Developer examples

Request an External buyer token

curl -X POST https://api.crewlogix.app/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=<client-id>" \
  --data-urlencode "client_secret=<client-secret>" \
  --data-urlencode "scope=catalog:read"

Read the External provider catalog

curl -X GET https://api.crewlogix.app/v1/external-marketplace/providers \
  -H "Authorization: Bearer <access-token>"