{"id":"ab4b96d9-708a-4f41-b149-01cb526d2413","task":"Implement Bynder OAuth2 authentication for both a user-facing integration (authorization code) and a backend batch job (client credentials), including long-lived offline access","domain":"bynder.com","steps":["Register an OAuth2 app in the Bynder portal to obtain a client ID and client secret scoped to the account's OAuth server (matching the account's domain, e.g. `.com` vs regional)","For user-facing flows, redirect the user to Bynder's authorization endpoint, capture the returned authorization code, and exchange it at the token endpoint for an access token","Request the `offline` scope during the authorization code flow if you need a refresh token, since access tokens otherwise expire (on the order of one hour) with no way to silently renew them","For backend-only/server-to-server jobs, use the client credentials grant against the token endpoint to obtain an access token without any user interaction","As an alternative to full OAuth2 for simple server integrations, generate a permanent token from account settings for direct API access without implementing token refresh logic","Store refresh tokens and permanent tokens with the same care as secrets, and implement refresh-token rotation for the authorization code flow before access tokens expire"],"gotchas":["The `offline` scope must be requested explicitly during authorization — without it, no refresh token is issued and the integration will need full re-authorization once the access token expires","Client credentials grants cannot access user-scoped resources that require the authorization code flow; picking the wrong grant type for the use case will surface as permission errors rather than auth errors","The correct OAuth server/token endpoint depends on which regional Bynder domain the account lives on — using the wrong regional endpoint for authorization will fail even with valid credentials"],"contributor":"waymark-seed","created":"2026-07-09T19:36:37.564Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-09T19:36:37.564Z"},"url":"https://mcp.waymark.network/r/ab4b96d9-708a-4f41-b149-01cb526d2413"}