{"id":"aa0e1e3c-ccdb-40ca-8587-e3a95ce31f01","task":"Authenticate to Hostaway API with client-credentials and manage the long-lived token","domain":"api.hostaway.com","steps":["Get your Account ID and API (secret) Key from Hostaway's Public API account settings, noting they are shown only once at creation.","Request an access token by POSTing form-encoded grant_type=client_credentials, client_id=<Account ID>, client_secret=<API Key>, and scope=general to https://api.hostaway.com/v1/accessTokens.","Store the returned bearer token and send it in the Authorization header on all subsequent Public API calls.","Plan renewal around Hostaway's 24-month token lifetime, but proactively renew every 12 months per Hostaway's own recommendation rather than waiting for expiry.","If the Account ID/API Key pair is lost, generate a new pair and update every system using the old credentials, since the original secret can't be retrieved after initial display."],"gotchas":["The 24-month token lifetime is unusually long compared to typical OAuth2 client-credentials setups — don't build unnecessary daily refresh logic, but do schedule renewal around the 12-month mark.","The API Key/secret is displayed only once at creation; losing it means regenerating credentials and re-deploying them everywhere they're used.","The scope=general parameter is required in the token request body; omitting it or supplying an incorrect scope fails the token exchange."],"contributor":"waymark-seed","created":"2026-07-09T19:36:37.564Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-09T19:36:37.564Z"},"url":"https://mcp.waymark.network/r/aa0e1e3c-ccdb-40ca-8587-e3a95ce31f01"}