Skip to content

Client authentication

You'll use client authentication to access the Discovery, Title Link, and Reporting APIs.

Once you've been approved for API access, OverDrive will provide a client key and client secret, which you'll use to get an access token. Learn about requesting API credentials.

Tip: The Title Link, Reporting, and Discovery APIs often require different client keys and secrets, and each must be requested separately. Note that Reporting API access can only be requested by the library that wants to use it.

Using OAuth tokens with client authentication

OverDrive's Discovery, Title Link, and Reporting APIs all use OAuth 2.0 "Client Credentials Grant" to authenticate your client credentials.

To get a client access token, send a POST request to this URL:

Resource URL

https://oauth.overdrive.com/token

Note: The integration and production environments both use this URL to get client tokens.

To create the POST request:

  • Combine your client key and client secret like this: clientKey:clientSecret.
    Note: Both the clientKey and clientSecret are case sensitive.
  • Use your programming language's libraries to encode the combined key and secret using a Base64 algorithm.
  • Apply the string to the Authorization header like this: Basic {Base64-encoded string}.

Example request

POST /token HTTP/1.1 
Host: oauth.overdrive.com 
Authorization: Basic {Base64-encoded client credentials} 
Content-Type: application/x-www-form-urlencoded;charset=UTF-8 

grant_type=client_credentials

Example response

200 OK
Cache-Control: no-store, must-revalidate, no-cache, max-age=0
Pragma: no-cache
X-Frame-Options: deny
Date: Tue, 11 Jun 2024 21:15:28 GMT
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 1228
Content-Type: application/json; charset=utf-8

{ 
	"access_token":"2YotnFZFEjr1zCsicMWpAA", 
	"token_type":"Bearer", 
	"expires_in":3600, 
	"scope":"LIB META SRCH AVAIL"
}
You'll use the token_type and access_token from the response in future Discovery, Title Link, and Reporting API calls in the Authorization header, as shown in the example below:
GET /v1/libraries/1225 HTTP/1.1 
Host: api.overdrive.com 
Authorization: {token_type} {access_token} 
User-Agent: {Your application} 
X-Forwarded-For: {Client IP Address}

In the response, you'll also see scopes, which tell you which APIs you have access to.

Scopes for the Discovery APIs and the Title Link API:

  • LIB: Library Account API
  • META: Metadata API
  • SRCH: Search API
    Note: SRCH is also the scope for the Title Link API.
  • AVAIL: Library Availability API

Note: You'll also have access to the Magazine Issues API and Digital Inventory API, which won't appear as scopes.

Scope for the Reporting API:

  • LIBREPORT: Checkouts Report API