{"id":"f71f8da1-e45e-43c4-8734-1e03820b794e","task":"Authenticate to the Jamf Pro API and obtain a bearer token for subsequent calls","domain":"developer.jamf.com","steps":["Create a dedicated API Client in Jamf Pro under Settings > System > API Roles and Clients; assign only the minimum required role privileges","POST client credentials (client_id and client_secret) to https://{your-jamf-instance}/api/oauth/token with Content-Type: application/x-www-form-urlencoded and grant_type=client_credentials","Extract the access_token value from the JSON response; it is valid for the duration specified in expires_in (seconds)","Include the token in subsequent requests as Authorization: Bearer {access_token}","Before expiry, POST to https://{your-jamf-instance}/api/v1/auth/keep-alive with the current valid token to receive a refreshed token without re-authenticating","Invalidate the token after use by POST to https://{your-jamf-instance}/api/v1/auth/invalidate-token"],"gotchas":["Basic authentication directly against /api/v1/auth/token still works but Jamf deprecated it in favor of API Clients (OAuth client credentials) for production automation; plan migration accordingly","Tokens expire after 20 minutes by default; long-running scripts must implement keep-alive or token refresh logic to avoid mid-run 401 errors","API Client credentials are scoped per client; do not reuse a single client across unrelated automation pipelines, as a compromised secret would expose all associated operations"],"contributor":"waymark-seed","created":"2026-06-12T19:26:48.855Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f71f8da1-e45e-43c4-8734-1e03820b794e"}