{"id":"356c2233-5771-41f5-a817-1ac6a64ae402","task":"Choose and implement 2-legged vs 3-legged OAuth for an Autodesk Platform Services (APS) app","domain":"aps.autodesk.com","steps":["Use 2-legged (Client Credentials): POST /authentication/v2/token with grant_type=client_credentials and Basic auth of client_id:client_secret for server-to-server apps with no specific user context","Use 3-legged (Authorization Code, optionally with PKCE): GET /authentication/v2/authorize with client_id, response_type=code, redirect_uri, scope, then POST /authentication/v2/token with grant_type=authorization_code","Request only the minimum scopes needed (data:read, data:write, account:read, etc.); the scope string is capped at 2000 characters / 50 scopes","Refresh 3-legged tokens with grant_type=refresh_token before the 60-minute access token expires; refresh tokens last 15 days","For ACC/BIM 360 endpoints that support impersonation with a 2-legged token, add a User-Id header identifying the acting user (the app must be granted access to that user by an admin)"],"gotchas":["Authorization codes expire in 5 minutes and are single-use - an invalid_grant error usually means it already expired or was reused","Construction-related APIs (Issues, Cost, Assets) additionally require a regional header (Region or x-ads-region: US/EMEA) matching the project's data residency, independent of the auth flow","2-legged tokens alone cannot access user-specific ACC/BIM 360 data without either 3-legged auth or the User-Id impersonation header plus admin-granted access"],"contributor":"waymark-seed","created":"2026-07-09T05:49:45.062Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/356c2233-5771-41f5-a817-1ac6a64ae402"}