Open Collective Authentication: API Access & Security (2026)

Authentication overview

Open Collective provides a GraphQL API that allows developers to interact programmatically with collective data, contributions, expenses, and user information. All API interactions requiring authenticated access utilize Personal Access Tokens (PATs) for authorization. These tokens grant applications and scripts the ability to perform actions that a user has permission to execute within the Open Collective ecosystem Open Collective API authentication details. Understanding the lifecycle and security implications of PATs is crucial for integrating with the platform effectively and securely.

The Open Collective API operates over HTTPS, ensuring that all data transmitted between your application and the API is encrypted in transit. While PATs are the primary method for authenticating programmatic requests, user authentication for the Open Collective web interface typically involves standard email/password combinations or third-party OAuth providers, which are distinct from API authentication methods Open Collective developer documentation.

Supported authentication methods

Open Collective primarily supports Personal Access Tokens (PATs) for authenticating API requests. Unlike OAuth 2.0, which often involves a multi-step authorization flow to obtain an access token on behalf of a user, PATs are long-lived tokens generated directly by a user within their account settings. These tokens are tied to the permissions of the user who generated them.

When a PAT is used in an API request, the Open Collective API verifies the token and grants access based on the permissions associated with the generating user. For instance, a PAT generated by an administrator of a collective would have the necessary permissions to manage expenses or update collective details via the API Open Collective API authentication guide. The absence of explicit token scopes means that the PAT inherits the full permissions of the user, making secure handling paramount.

Getting your credentials

To obtain a Personal Access Token (PAT) for Open Collective, follow these steps:

1. Log in to Open Collective: Navigate to the Open Collective website and log in to your user account Open Collective homepage.
2. Access User Settings: Once logged in, click on your profile picture or avatar, usually located in the top right corner, and select "Settings" or "Profile Settings."
3. Navigate to API Keys/Tokens: Within your user settings, look for a section related to "API Keys," "Developer Settings," or "Personal Access Tokens." The exact naming might vary, but it will be in a section dedicated to developer access.
4. Generate a New Token: Click on the option to generate a new token. You may be prompted to provide a name or description for the token. This helps you identify its purpose later, especially if you create multiple tokens for different applications.
5. Copy the Token: After generating, the PAT will be displayed once. Copy this token immediately and store it securely. For security reasons, Open Collective will not display the token again after you navigate away from the page Open Collective PAT generation instructions.

It is important to treat your PAT like a password, as it grants access to your account's capabilities within the Open Collective API. Do not embed it directly into client-side code or public repositories.

Authenticated request example

Once you have obtained your Personal Access Token (PAT), you can use it to authenticate your requests to the Open Collective GraphQL API. The PAT should be included in the Authorization header of your HTTP request, prefixed with Bearer.

GraphQL Query Example (using curl)

This example demonstrates how to fetch basic information about a collective using a PAT.

curl -X POST \
  https://api.opencollective.com/graphql \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN' \
  --data-raw '{
    "query": "query Collective($slug: String) { collective(slug: $slug) { name slug description } }",
    "variables": { "slug": "open-collective" }
  }'

Replace YOUR_PERSONAL_ACCESS_TOKEN with your actual PAT and open-collective with the slug of the collective you wish to query. The GraphQL endpoint for Open Collective is https://api.opencollective.com/graphql Open Collective API endpoint details.

Example Response

{
  "data": {
    "collective": {
      "name": "Open Collective",
      "slug": "open-collective",
      "description": "A platform for communities to collect and disburse money transparently."
    }
  }
}

This response structure is typical for GraphQL APIs, returning data in a JSON object under the data key. Errors would typically appear under an errors key GraphQL query syntax.

Security best practices

Securely managing your Open Collective Personal Access Tokens (PATs) is critical to protect your account and collective data. Adhering to these best practices helps mitigate risks associated with API access:

• Treat PATs as passwords: Your PAT grants the same level of access to the API as your user password grants to the web interface. Never share your PATs, commit them to public repositories, or hardcode them directly into client-side code (e.g., JavaScript in a web browser) AWS security best practices for access keys.
• Secure storage: Store PATs in secure environments. For server-side applications, use environment variables, dedicated secrets management services (e.g., AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault), or encrypted configuration files. Avoid storing them in plain text on disk.
• Regular rotation: Periodically rotate your PATs. This practice reduces the window of exposure if a token is compromised. While Open Collective does not enforce automatic rotation, establishing a regular schedule (e.g., every 90 days) is a strong security measure. After generating a new token, update all applications using the old token and then revoke the old one immediately.
• Least privilege: Although Open Collective PATs inherit the full permissions of the generating user, ensure the user account generating the PAT has only the necessary permissions for the API tasks it needs to perform. For instance, if an integration only needs to read collective data, avoid using a PAT from an administrator account if a less privileged account could be used.
• Monitor usage: Regularly review the activity associated with your API integrations. While Open Collective may not provide detailed PAT usage logs directly, monitoring your application's interaction patterns can help detect unauthorized activity.
• Revoke unused or compromised tokens: Immediately revoke any PATs that are no longer needed or if you suspect they have been compromised. You can manage and revoke your PATs from your Open Collective user settings Open Collective token revocation.
• HTTPS only: Always ensure your API requests are made over HTTPS to encrypt data in transit and protect your PAT from interception during transmission. Open Collective's API enforces HTTPS.