Authentication
Authentication
Overview
Authentication is based on JSON Web Token (JWT) (RFC 7519). Clients authenticate using credentials to obtain:
JWT Access Token (short-lived) – used for API authorization
JWT Refresh Token (long-lived) – used to request new access tokens
All protected APIs require the Access Token in the header:
Content-Type: application/json
X-Authorization: Bearer <AccessToken>Note: The Access Token API itself does not require
X-Authorization.
Support Access Feature (Resellers)
Resellers can access a child account (at any level) without needing the child’s API credentials.
Provide
targetAccountIdduring loginAccess to the child account is logged and visible in the child’s activity logs
POST Access Token
Authenticates a user and returns Access/Refresh tokens.
Endpoint
POST /api/loginHeaders
Content-Type: application/json
X-Requested-With: XMLHttpRequestBody (JSON)
Field | Mandatory | Description |
|---|---|---|
username | Yes | User name for the organization |
password | Yes | Password for the user |
targetAccountId | No | Child organization account ID (available only at reseller level) |
Output (success)
Field | Description |
|---|---|
AccessToken | Access Token for the requested account |
RefreshToken | Refresh Token for the requested account |
GET Refresh Token
Generates a new Access Token and Refresh Token using the Refresh Token.
Endpoint
GET /api/RefreshTokenHeaders
Content-Type: application/json
X-Requested-With: XMLHttpRequest
X-Authorization: Bearer <RefreshToken>Output (success)
Field | Description |
|---|---|
AccessToken | New access token |
RefreshToken | New refresh token |
Common error/result codes (from API documentation)
Code | Description |
|---|---|
10126 | BadCredential Exception: Username or Password not valid |
10117 | Incorrect value in |
11044 | Account blocked due to multiple failed login attempts (reset password via “Forgot Password”) |
10126 | Timeout may be returned with timeout messaging (see Response Time & Timeout) |
Notes
In the Postman collection, the returned Access Token is typically saved into the environment variable (e.g.
Auth_Key) and automatically sent in subsequent API calls.