All v2 endpoints use two forms of authentication to best suit your use-case once your app is registered.

- Userless Auth
- User Auth

## Userless Auth

This is used for server-side applications and others that don't intend to require a Foursquare or Swarm user's permissions.

To make a userless request, specify your consumer key's **Client ID** and **Secret** instead of an auth token in the request URL.

cURL

```curl
curl --request GET \
     --url https://api.foursquare.com/v2/venues/search?ll=40.7,-74&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&v=YYYYMMDD \
     --header 'Accept: application/json'
```

## User Auth

This is used when you require a Foursquare or Swarm user e.g. to get all the checkins for a given user.

- Native App Auth
- Web App Auth

### Android / iOS Apps

Native auth is the easiest way for users to connect with Foursquare. Unlike the web-based OAuth flow documented below, our native flow leverages the Foursquare app already installed on your users’ phones, saving users the hassle of re-logging in to Foursquare within your app. Native auth is the only flow that supports users logging in to Foursquare using Facebook.

To use native auth, incorporate our utility classes for iOS or Android into your app. Additional instructions are provided in the repositories' README files.

### Web Applications

We use OAuth 2.0 to provide authorized access to our API. Here is a sample recommended work-flow:

**Step 1**

Direct users to Foursquare with your registered redirect uri.

HTTP

```http
https://foursquare.com/oauth2/authenticate
    ?client_id=YOUR_CLIENT_ID
    &response_type=code
    &redirect_uri=YOUR_REGISTERED_REDIRECT_URI
```

**Step 2**

If the user accepts, they will be redirected back to your URI with a code.

HTTP

```http
https://YOUR_REGISTERED_REDIRECT_URI/?code=CODE
```

**Step 3**

Your server should exchange the code it got in step 2 for an access token.

HTTP

```http
https://foursquare.com/oauth2/access_token
    ?client_id=YOUR_CLIENT_ID
    &client_secret=YOUR_CLIENT_SECRET
    &grant_type=authorization_code
    &redirect_uri=YOUR_REGISTERED_REDIRECT_URI
    &code=CODE
```

The response will be JSON.

JSON

```json
{ "access_token": ACCESS_TOKEN }
```

**Step 4**

Once you have an access token, you can use any of the endpoints by adding an Authorization header of `Bearer <ACCESS_TOKEN>` to your `GET` or `POST` request.

For example, from the command line, you can do:

cURL

```curl
curl -XGET -H 'Authorization: Bearer <ACCESS_TOKEN>' 'https://api.foursquare.com/v2/users/self/checkins?v=YYYYMMDD'
```