Skip to content
Schedule Social Media
SchedulersNetworksAPI changesGuidesToolsCompareFind your schedulerNews

Press Esc to close.
New feature Pinterest Severity: low

Pinterest adds the Client Credentials grant for app-owner tokens

AnnouncedSept 2024
EffectiveSept 2024
PlatformPinterest

What changed

Pinterest's changelog lists Client Credentials authorization grant under authentication in September 2024. The authentication guide says the grant is for an app acting on its own behalf, so the token belongs to the app owner; it needs two-factor authentication, returns a token with a pinc prefix and no refresh token, and works only on endpoints whose API reference lists Client Credentials. The changelog entry text was not readable, so the launch day is not stated.

What it means

An app can get an access token for its own developer account without a user clicking through the OAuth screen, which suits server jobs that work on the app owner's account.

Who is affected

Developers who automate API calls for their own Pinterest account, such as nightly jobs or internal tools. Apps that act for other users still need the Authorization Code grant.

What to do by Sept 2024

Optional. For machine-to-machine calls on your own account, request a token with grant_type=client_credentials and the scopes you need; turn on two-factor authentication first and keep the client secret on the server.

What this means for you

Usually an app has to ask you to log in and press "allow" before it can use your Pinterest account. Since September 2024, a developer can skip that step, but only for their own account. It helps people who run small scripts on their own Pinterest profile. It changes nothing for apps that post for other people: those still ask you to approve them.

The details

  • Token request: POST https://api.pinterest.com/v5/oauth/token with HTTP Basic auth (client_id:client_secret), grant_type=client_credentials and a scope list such as boards:read,pins:read. No authorization code and no redirect step.
  • Response: the access token starts with pinc (Authorization Code tokens start with pina), response_type is client_credentials and the example shows expires_in: 2592000 (30 days). The example response has no refresh token.
  • Whose account: the guide says the token "is on behalf of the current app owner", for machine-to-machine use such as cron jobs.
  • Requirements: two-factor authentication must be on. Pinterest warns the flow is less secure because there is no approval step, so store the secret safely.
  • Endpoint coverage: some endpoints that read or write sensitive data do not accept these tokens. Check the Authorizations section of each endpoint in the API reference. In the OpenAPI spec the scheme first appears in v5.14.0 (August 14, 2024); in v5.28.0 it is listed on pins/create, boards/create and multi_pins/analytics, but not on user_account/analytics or media/create (video upload).
  • Doc note: the guide's parameter table for this grant says to set grant_type to authorization_code, while its example request uses client_credentials. The example matches the grant's name.

What to do next

  • Business owners: Nothing.
  • Marketers and agencies: Nothing. Client tools still connect with the normal Pinterest login.
  • Developers: Use it for jobs on your own account, check each endpoint's Authorizations list first, and since the example response carries no refresh token, request a fresh token when expires_in runs out.

Primary sources

Checked against the source 7 Nov 2026

Get an email when a new API change is added

Follow new entries with the RSS feed. Each platform also has its own feed, for example X or Meta.