Already a NinjaOne customer? Log in to view more guides and the latest updates.

API OAuth Token Configuration

  • Last Updated August 19, 2026

Topic

This article explains how to use OAuth 2.0 to authenticate requests to NinjaOne Public API.

Environment

NinjaOne Public API

Description

The NinjaOne Public API uses OAuth 2.0 to authenticate requests. OAuth 2.0 allows applications to access NinjaOne resources (such as monitoring information) made available via the Application Programming Interface (API).

Only system administrators may configure OAuth tokens for the NinjaOne Public API. To start using the OAuth protocol for your app’s authentication with NinjaOne, you must first have an OAuth app credential from NinjaOne. The OAuth app will set up an authorization grant for you. OAuth 2.0 supports various grant types. However, NinjaOne Public API only supports authorization code and implicit grant types.

If you have any questions about API configuration, documentation, or OAuth Tokens, you can contact our API Team at [email protected].

Generate an OAuth Client Application

To generate an OAuth client app ID in NinjaOne, perform the following steps.

  1. Navigate to API settings at Administration → Apps → API.
  2. Open the Client app IDs tab and click + Add client app.
API_add client app.png
Figure 1: Add a new client app configuration in NinjaOne
  1. Select an option from the Application Platform drop-down menu to generate more data fields.
Certain grant types may not be available depending on your selection in this step.
  1. Use the following table to help you fill out the applicable fields.
FieldDescription
NameEnter the title that will be displayed as the client application name in the consent screen.
This name will be displayed in the Administration → Apps → API → OAuth Tokens in NinjaOne.
Redirect URLsEnter one or more addresses where NinjaOne will send OAuth responses. This is not configurable when using the Native application platform option.
Scopes

These options allow access to all Public API Resources of a certain type.

  • Monitoring: Grants read-only access to monitoring data and organization structure.
  • Management: Allows modification of device and organization information, including creating new organizations, adding new devices, running scripts, and others.
  • Control: Activates remote access via API.
Allowed Grant Types

NinjaOne uses OAuth 2.0 grant types for the client application acting on behalf of a user.

  • Authorization code: The Authorization Code is a temporary code that the client will exchange for an access token. NinjaOne obtains the code for the authorization server, where the user can view what information the client requests and approve or deny the request.
  • Client credentials: This flow bypasses the code exchange step and is an alternative to the authorization code. Instead, the access token is immediately returned to the client in the query string fragment.
  1. After the configuration is complete, click Save.

To edit or delete a client app ID, move your mouse cursor over the row and select the applicable option.

delete client app.png
Figure 2: Edit or delete a client app configuration in NinjaOne

Additional Resources

Refer to NinjaOne Documentation: Public API to learn more about using the API with NinjaOne.

FAQ

Next Steps