Create Client
Before you can call any protected endpoint you need an API client. A client is the identity the integration service attaches your permissions, grant types, IP allow-list, rate limits, monthly usage quota, usage window and (optionally) client certificate to.
Create a Token
Exchanges your client credentials for an access token and a refresh token. Every other partner endpoint takes the access token as Authorization: Bearer . expires_in is a lifetime in seconds (RFC 6749 §5.1), not a timestamp.
mTLS Client Certificates
When the operator marks your client as requiring a certificate (require_certificate = true), every call, including the token request, must be made over a TLS connection on which your client presented the certificate issued to it. Possession of the private key is proven by the TLS handshake itself; nothing goes in an HTTP header.