OAuth2

Authorization code grant. Your client is not tied to a camp when you create it. Each token is issued for the camp that authorises your app.

Authorize

GET https://scoutcamp.co.uk/oauth/authorize
  ?client_id=sc_app_…
  &redirect_uri=https://yourapp.example/callback
  &response_type=code
  &scope=camp.read children.read
  &state=…
  &code_challenge=…
  &code_challenge_method=S256

Camp users sign in on scoutcamp.co.uk — the same camp-code login as the website, with an authorise step afterwards. Only MASTER, camp administrators, or leaders with the OAuth2 applications permission can complete this. Token and API calls stay on this developer host.

Token

POST https://developer.scoutcamp.co.uk/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=…&redirect_uri=…&client_id=…&client_secret=…

Refresh with grant_type=refresh_token. Access tokens last one hour.

Request only the scopes you need. The payload for each scope is listed on Scopes.

Camp leaders who authorise your app accept the Scout Camp Terms (Section 9). Read responses stay non-personal. Write and registration requests may include medical details. You must not collect camp consent over the API — Scout Camp emails the permission slip and a signature request. Scout Camp is not liable for data sent to your software.