Authentication
Total Parks auth docs
How agents and developers authenticate to the totalparks API. Product name: Total Parks.
OAuth
User and operator OAuth is published as RFC 8414 authorization-server metadata on the API host: https://api.totalparks.com.au/.well-known/oauth-authorization-server. That document is the machine-readable source for token and authorization endpoints.
Anonymous reads and cart tokens
Public discovery operations advertised in the Total Parks OpenAPI specification can be called without a user token. Guest checkout uses a bearer cart token created by POST /carts. That token is not an OAuth access token and is scoped to one cart.
Personal access tokens
Personal access tokens use the tp_pat_ prefix and are sent as Authorization: Bearer. They are for authenticated Total Parks users, not for anonymous park Q&A. Prefer the Total Parks MCP connector for unauthenticated park facts.