Authentication

You can use the API as a multiplier, customer, voucher owner, public user or with an api key.

Depending on your role, some endpoints, resources or attributes may not be available.

The authorization flow is:

You have to make an initial request to the authorization endpoint

The authorization endpoint exchanges your credentials for a JSON Web Token (JWT) upon success.

You can now access other API endpoints using the obtained JWT.

A JWT is a login secret just like a password

Keep in mind that the generated JWT, just like your credentials, grants access to your account and allows to make requests on your behalf. Don't share or distribute it.

JSON Web Token (JWT)

A JSON Web Token is a string matching the pattern

[encoded header].[encoded payload].[encoded signature]

The encoding is Base64 which does not contain the period character, so you can safely split the string at . to retrieve the three parts. A typical example after Base64 decoding would be:

header = {
  "typ": "JWT",
  "alg": "HS256"
}

payload = {
  "sub": "58e262c93aaf3b3fdf47691f", // entity id
  "exp": 1519642499, // expiration date 
  "aud": "api_access" // entity type (multiplier, customer, voucher_owner or api_access)
}

For debug purposes, you can use web services like jwt.io to decode a JWT.

Authentication

Authentication#

JSON Web Token (JWT)#

Authentication

JSON Web Token (JWT)