Authentication

Request an Access Token

Start by calling POST /connect/token to authenticate your application and request an access token.

Include the required credentials and grant type in the request body.

Example request:

http
POST /connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=YOUR_CLIENT_ID&
client_secret=YOUR_CLIENT_SECRET

Example response:

json
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Store and Manage the Token

After receiving the token:

• Save it securely in memory, server-side storage, or a secure token cache.
• Track the expires_in value to know when the token must be refreshed.
• Implement retry and refresh logic for expired or invalid tokens.
• Avoid logging sensitive authentication values in production environments.

Recommended practices:

• Use HTTPS for all authentication requests.
• Rotate client credentials periodically.
• Restrict token scope and permissions whenever possible.

Authorize Protected API Requests

Send the access token on all protected requests using the Authorization header.

Example:

http
Authorization: Bearer YOUR_ACCESS_TOKEN

Example protected request:

http
GET /api/orders
Authorization: Bearer YOUR_ACCESS_TOKEN

Common authentication responses:

• 401 Unauthorized → Missing, expired, or invalid token
• 403 Forbidden → Token does not have sufficient permissions

Best practices:

• Validate authentication failures gracefully.
• Implement centralized authorization handling in your API client.
• Avoid hardcoding tokens directly into source code.

Test and Validate Authentication

Before deploying:

• Verify token generation succeeds in all environments.
• Confirm protected endpoints accept valid bearer tokens.
• Test expired token handling and refresh behavior.
• Validate error responses for invalid credentials and unauthorized access.
• Ensure secrets are properly configured in CI/CD and deployment pipelines.

Recommended checks:

• Authentication requests use HTTPS only
• Tokens are not exposed in logs or browser storage
• Unauthorized requests return expected error codes
• API permissions and scopes behave correctly