Authentication — what the docs say, and what the file does
OAuth 2.0 with two grant types, a dedicated auth host — and a collection that promises tooling it doesn't contain.
The API uses OAuth 2.0, on its own host
Every request to api.app.iwave.com carries a Bearer token obtained from a
different host, auth.app.iwave.com. The configuration, from the public
Onboarding Guide (Step 2):
| Setting | Value |
|---|---|
| Token type | Access Token |
| Header prefix | Bearer |
| Auth URL | https://auth.app.iwave.com/oauth2/authorize/ |
| Access Token URL | https://auth.app.iwave.com/oauth2/token/ |
| Refresh Token URL | https://auth.app.iwave.com/oauth2/token/ |
| Scope | https://api.app.iwave.com/integration |
Note the scope is a URL — a common OAuth 2.0 style where the scope names the resource server it grants access to.
Choosing a grant type
The guide gives an unusually clear decision rule:
"Authorization Code is commonly used when multiple individuals will need to authenticate their personal connections to iWave"
"Client Credentials is best for automation, where a single system-level user can be assigned to the connection."
So: building a CRM plugin where each fundraiser connects their own account → Authorization Code (and you must supply Kindsight your callback URLs for allowlisting, dev and prod). Building a nightly sync job → Client Credentials.
Operational behaviour to build in
The collection description states two operational rules worth engineering for from day one:
"Token Management: Re-authenticate automatically if you receive a
401 Unauthorizederror.""Rate Limiting: Implement exponential backoff for retries to avoid rate limit blocks."
Neither an expiry duration nor a numeric rate limit is stated anywhere in the
public sources — so treat the 401 as your expiry signal rather than
scheduling around an assumed lifetime, and back off exponentially on 429s.
And now the teaching moment: finding G1
The collection's own Quick Start tells you to run a login request from an Authentication folder and rely on collection-level authorization. Open the file: neither exists. See finding G1 for the full evidence, re-verified against the file at every ingest. Configure OAuth yourself in Postman (right pane of the collection, Authorization tab → OAuth 2.0) using the table above.
Why this site never asks for your credentials: a teaching site is exactly the wrong place to paste a client secret. The Try-it panels here run in simulated mode or against a Postman mock server — never against the real API. For real calls, copy the generated snippets and run them from your own environment.