API Authentication

The partner, who is making the API requests, must include a specific type of header, called the "authorisation header", in each request they make. The header should contain a unique token, called a "bearer access token". This token serves as a form of authentication, verifying that the request is coming from a legitimate and authorised source.

Prerequisites

Parameter	Description
client_id	A unique client id that is shared for each partner.
client_secret	A unique key that is auto-generated for each product configured for the partner.

A client ID and secret are provided to each partner and are required in order to use the API. If you do not have a client ID and secret, please refer to the getting API credentials section for information on how to obtain them.

API Responses

Access Token Generated

The input parameters are correct and an access token is generated.

HTTP Status Code: 200

JSON Response

{
    "access_token": "eyJhbGciOiJSb5J4ZTZ…",
    "expires_in": 18000,
    "refresh_expires_in": 1800,
    "token_type": "Bearer",
    "not-before-policy": 1621349762,
    "session_state": "98ffa630-af77-4312-b4b87fc",
    "scope": ""
}

Unauthorised - Invalid Credentials

The client secret key parameter or its value is either missing or incorrect. The partner must check the client's secret key before sending the request.

HTTP Status Code: 401

JSON Response

{
   "error": "unauthorized_client",
   "error_description": "INVALID_CREDENTIALS: Invalid client credentials"
}