curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=secret&secretKey=YOUR_SECRET_KEY"
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=refresh&refreshToken=YOUR_REFRESH_TOKEN"
{
"header": {
"code": 1,
"message": "Access token created successfully!",
"response_code": 1
},
"body": {
"accessToken": "string",
"refreshToken": "string",
"expiry": 3600,
"resellerId": "string",
"resellerUid": "string"
}
}
Overview
API Access Authentication
Exchange your Secret Key for an Access Token, and refresh it when it expires.
POST
/
auth
/
v2
/
accessToken
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=secret&secretKey=YOUR_SECRET_KEY"
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=refresh&refreshToken=YOUR_REFRESH_TOKEN"
{
"header": {
"code": 1,
"message": "Access token created successfully!",
"response_code": 1
},
"body": {
"accessToken": "string",
"refreshToken": "string",
"expiry": 3600,
"resellerId": "string",
"resellerUid": "string"
}
}
Get an Access Token by using an authorized Secret Key. The API returns the Access Token along with its expiry and a Refresh Token. To obtain a renewed Access Token after expiry, make the same call with the Refresh Token.
See Errors for the response envelope and the full list of codes.
When the token expires, request a new one with
- URL:
/auth/v2/accessToken - Full URL:
<base_url>/auth/v2/accessToken - Request Method: POST
Request Body
Send the fields as form data (application/x-www-form-urlencoded).
string
required
How the Access Token is granted. One of
secret or refresh.string
Secret Key from the Partner Console. Required when
grantType is secret.string
Refresh Token returned by a previous call to this endpoint. Required when
grantType is refresh.Keep your Secret Key server-side. Never use it in client code or commit it to source control.
Sample Request
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=secret&secretKey=YOUR_SECRET_KEY"
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=refresh&refreshToken=YOUR_REFRESH_TOKEN"
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=secret&secretKey=YOUR_SECRET_KEY"
curl -X POST "<base_url>/auth/v2/accessToken" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Accept: application/json" \
-d "grantType=refresh&refreshToken=YOUR_REFRESH_TOKEN"
Response
object
object
Show body
Show body
string
Access Token to send in the
X-AccessToken header on every authenticated call.string
Refresh Token for the next call to this endpoint with
grantType set to refresh.number
Number of seconds the Access Token is valid for.
string
Identifier of your reseller account.
string
Unique identifier of your reseller account.
Sample Response
Success
{
"header": {
"code": 1,
"message": "Access token created successfully!",
"response_code": 1
},
"body": {
"accessToken": "string",
"refreshToken": "string",
"expiry": 3600,
"resellerId": "string",
"resellerUid": "string"
}
}
{
"header": {
"code": 1,
"message": "Access token created successfully!",
"response_code": 1
},
"body": {
"accessToken": "string",
"refreshToken": "string",
"expiry": 3600,
"resellerId": "string",
"resellerUid": "string"
}
}
Status Codes
| Status | Meaning |
|---|---|
200 | Successful response. |
Error codes
Returned inheader.response_code when the request fails.
| Code | Message |
|---|---|
998 | Internal server error |
1001 | Validation error |
1002 | You are not permitted to the resource! |
Using the token
Send the Access Token in theX-AccessToken header on every other call:
Send the Access Token in the X-AccessToken request header on every authenticated call:
X-AccessToken: YOUR_ACCESS_TOKEN
grantType=refresh instead of sending your Secret Key again.