Why Clio OAuth tokens fail: two systems, four regions, and rotation rules
Developers integrating with Clio's API often encounter 401 errors due to confusion between its two OAuth systems: the older Clio Manage, with 30-day access tokens and stable refresh tokens, and the newer Clio Platform, with 24-hour access tokens that rotate on every refresh. Failing to save the new refresh token after each Platform API call immediately invalidates the old one, causing silent authentication failures. Clio also operates four separate regional instances — US, EU, Canada, and Australia — and tokens issued in one region are not valid in another, with each region requiring its own registered app credentials. On the Manage system, a firm administrator revoking access from within Clio settings deauthorizes both access and refresh tokens permanently, unlike an app-initiated revocation which only invalidates the supplied access token. Developers are advised to always read the expires_in value from each response rather than hardcoding token lifetimes, and to account for regional deployments before assuming a token or code is at fault.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in