To access protected parts of the API you need to obtain an access token. The following page shows how to obtain an access token.

Basic

The most basic way to obtain an access token is to use your personal credentials.

Request

POST /consumer/login
Content-Type: application/json

{
  "username": "[username]",
  "password": "[password]"
}

Response

{
  "token": "",
  "expires_in": "",
  "refresh_token": ""
}

OAuth2

It is also possible to use the OAuth2 authorization endpoint.

Client credentials

Request

POST /authorization/token
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

As Basic authorization header you need to provide the [app key] + ":" + [app secret] as base64 encoded string. It is also possible to provide your username and password but in general it is recommended to use the app key and secret since the app access can always be revoked later on.

Response

{
  "access_token": "",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": ""
}

Refresh token

Most token responses always include a refresh token. You can use this refresh token to extend an access token before it expires.

Request

POST /authorization/token
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&refresh_token=[refresh_token]

Like at the client credentials call the Basic header must contain the base64 encode app key and secret.

Response

{
  "access_token": "",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": ""
}

As response you will get a new access token.