Authentication

Every API request must carry a bearer credential in the Authorization header. Two kinds of credentials exist, with the same scopes and the same per-user isolation:

• API keys for your own scripts, servers and integrations;
• OAuth 2.1 access tokens for applications acting on behalf of other Meetingize users (AI assistants via the MCP server, third-party apps).

Authorization: Bearer mtgz_live_k7Hq2x9a_3bV...

API keys

Create keys in the web app, Settings > Developers > Create a key. Keys are never created or revoked through the API itself.

• Format: mtgz_live_<id8>_<secret32>.
• The full key is displayed once. Meetingize only stores a SHA-256 hash of it, plus the prefix (mtgz_live_k7Hq2x9a) and the last 4 characters for display.
• Each key has a name, scopes, an optional expiration date, a “last used” date and IP, and can be revoked at any time. Revocation is immediate.
• Treat keys like passwords: keep them server-side, in a secret manager or environment variable, never in a browser or a mobile app.

Scopes

Scope	Grants
read:meetings	list and search meetings, details, AI report, participants, templates, personas
read:transcripts	transcripts (json, md, txt, srt, vtt); with read:meetings, the LLM-ready export
read:documents	list and download generated documents (json, md, pdf, docx)
write:documents	generate documents (asynchronous jobs, billed on usage)
write:meetings	create meetings from audio or video files or URLs (billed on usage), update their title, date, tags and participants, delete them
webhooks	manage webhook endpoints through the API, send tests, read the delivery log
read:usage	current consumption, wallet and ledger

GET /me and GET /jobs work with any valid credential (a job is only visible to its owner). A call without the required scope answers 403 insufficient_scope.

OAuth 2.1

Meetingize is an OAuth 2.1 authorization server. It is what AI assistants use when you connect the MCP server, and any application can use it to act on behalf of a Meetingize user with their explicit consent.

Item	Value
Discovery (RFC 8414)	https://app.meetingize.com/.well-known/oauth-authorization-server
Protected resource metadata (RFC 9728)	https://app.meetingize.com/.well-known/oauth-protected-resource/api/mcp
Authorization endpoint	https://app.meetingize.com/api/oauth/authorize
Token endpoint	https://app.meetingize.com/api/oauth/token
Dynamic client registration (RFC 7591)	https://app.meetingize.com/api/oauth/register
Revocation (RFC 7009)	https://app.meetingize.com/api/oauth/revoke
Grant types	authorization_code (with PKCE), refresh_token
PKCE	required, S256 only
Client authentication	none (public clients), client_secret_post, client_secret_basic
Client ID Metadata Documents	supported: an https:// URL can be used as client_id
Access token lifetime	1 hour, refresh tokens 30 days with rotation

Flow

1. Register your client once (or use a Client ID Metadata Document):

   curl -s -X POST https://app.meetingize.com/api/oauth/register \
     -H "Content-Type: application/json" \
     -d '{"client_name": "My CRM sync", "redirect_uris": ["https://crm.example.com/oauth/callback"],
          "grant_types": ["authorization_code", "refresh_token"], "token_endpoint_auth_method": "none"}'

   Redirect URIs must be https, http on a loopback address (localhost, 127.0.0.1) for native apps, or a private-use scheme (myapp://...).

2. Redirect the user to the authorization endpoint with response_type=code, your client_id, redirect_uri, scope, state, code_challenge (S256) and optionally resource. The user signs in to Meetingize if needed, sees a consent screen listing the requested permissions, and allows or denies.

3. Exchange the code at the token endpoint with the code_verifier:

   curl -s -X POST https://app.meetingize.com/api/oauth/token \
     -d grant_type=authorization_code -d code=... -d redirect_uri=https://crm.example.com/oauth/callback \
     -d client_id=... -d code_verifier=...

4. Call the API with Authorization: Bearer <access_token> and refresh it with grant_type=refresh_token before it expires.

The resource parameter (RFC 8707) is accepted for the MCP server URL (https://app.meetingize.com/api/mcp) and the API base URL; any other value is refused with invalid_target.

What the user controls

Users see every connected application in Settings > Connected applications, with the permissions granted and the last use, and can disconnect any of them. Disconnection revokes access and refresh tokens immediately.

Errors

Status	code	Meaning
401	missing_credentials	no Authorization header
401	invalid_api_key, invalid_token	unknown, malformed or expired credential
401	api_key_revoked, api_key_expired	the key was revoked or reached its expiration date
403	insufficient_scope	the credential lacks the scope required by the endpoint