Authentication

We use bearer authentication with JSON Web Tokens (JWT). Only users with a valid token can access the API.

You can find this token in the Customer Portal. Go to Identity and Access in the menu and click API tokens to manage tokens. Tokens can have two access types that cannot be changed after creation:

Read only — to retrieve data; this token is allowed to perform only GET requests.
Read & write — such tokens have full access to the API and are permitted to make changes.

Here is an example of a token:

eyH0eV1WiLCJhbC7ghGceCOiJIUxL1MiJ5.eyJpZCI6MjN9SDQsIn2VyFGjkIiwiYWNjXHFzX2dyYW50X2lkIkexNzExMywiHZhwEknoMjEwNzYwUTOwfQ.kDi0gFY2KzzlEFFcbC1KNTL9rZXOlTtN6tI8M8rPJqF5

Each API token is valid for 20 years, so you don't need to worry about renewal. Keep your API token inaccessible to any third parties — if it's disclosed, revoke it immediately from the Customer Portal as soon as possible. Keep the API token in a safe place; if lost, it can't be recovered and you'll need to create a new one.

This token has to be added to the authorization header of a request to access protected resources. A cURL command to get a list of all the server models in Luxembourg looks this way:

curl -H "Authorization: Bearer eyH0eV1WiLCJhbC7ghGceC.eyJpZCI6MjN9SDQsInZhwEknoMjEwNzYwUTOwfQ.kDi0gFZXOlTtN6tI8M8rPJqF5" -g "https://api.servers.com/v1/locations/5/order_options/server_models" -X GET

Make sure to include the token in the Authorization header. If the token is missing or incorrect, you'll receive a 401 status code with the following response:

{"message":"Unauthorized","code":"UNAUTHORIZED"}

The bearerAuth scheme is used for every request. Read more about bearer authentication.

Authorization: Bearer <JWTtoken>