To access protected parts of the API you need to obtain an access token. The following page shows how to obtain an access token.
The most basic way to obtain an access token is to use your personal credentials.
Request
POST /consumer/login Content-Type: application/json { "username": "[username]", "password": "[password]" }
Response
{ "token": "", "expires_in": "", "refresh_token": "" }
It is also possible to use the OAuth2 authorization endpoint.
Request
POST /authorization/token Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=client_credentials
As Basic authorization header you need to provide the [app key] + ":" + [app secret]
as base64
encoded string. It is also possible to provide your username and password but in general it is recommended to use the
app key and secret since the app access can always be revoked later on.
Response
{ "access_token": "", "token_type": "bearer", "expires_in": 3600, "refresh_token": "" }
Most token responses always include a refresh token. You can use this refresh token to extend an access token before it expires.
Request
POST /authorization/token Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=refresh_token&refresh_token=[refresh_token]
Like at the client credentials call the Basic header must contain the base64 encode app key and secret.
Response
{ "access_token": "", "token_type": "bearer", "expires_in": 3600, "refresh_token": "" }
As response you will get a new access token.