Authorization through POST Parameters

Password = [PASSWORD]

Username and password value used to authenticate incoming request. These values are defined in CLIENT API application for each integrator.

Authorization through Header

Instead of sending credentials in plain text through post parameters, an authenticated request includes the Authorization Header Variable. If this header is not included, the request is anonymous and may not succeed against API services.

To authenticate a request, you must encode the combined username and password in the request.

The format for the Authorization header is as follows:

Authorization: Basic [Encoded-Base64-String]

Constructing the Basic Authentication

Username and password are combined into a string “username:password”

The result string is then encoded using Base64.

In Header authorization, add “Basic” before the encoded string. There should be space in between “Basic” and encoded string

Authorization through POST Parameters

Token-based authentication is a protocol which allows users to verify their identity, and in return receive a unique access token. During the life of the token, users then access the website or app that the token has been issued for, rather than having to re-enter credentials each time they go back to the same webpage, app, or any resource protected with that same token.

Auth tokens work like a stamped ticket. The user retains access as long as the token remains valid. Once the user logs out or quits an app, the token is invalidated.

Token-based authentication is different from traditional password-based or server-based authentication techniques. Tokens offer a second layer of security, and administrators have detailed control over each action and transaction.

Token Authentication in 4 Easy Steps:

Use a token-based authentication system, and visitors will verify credentials just once. In return, they'll get a token that allows access for a time period you define.

The process works like this:

Request: The person asks for access to a server or protected resource. That could involve a login with a password, or it could involve some other process you specify. Verification: The server determines that the person should have access. That could involve checking the password against the username, or it could involve another process you specify. Tokens: The server communicates with the authentication device, like a ring, key, phone, or similar device. After verification, the server issues a token and passes it to the user. Storage: The token sits within the user's browser while work continues.

If the user attempts to visit a different part of the server, the token communicates with the server again. Access is granted or denied based on the token.

Administrators set limits on tokens. You could allow a one-use token that is immediately destroyed when the person logs out. Or you could set the token to self-destruct at the end of a specified time period.

A JSON Web Token consists of three parts: Header, Payload and Signature. The header and payload are Base64 encoded, then concatenated by a period, finally the result is algorithmically signed producing a token in the form of header.claims.signature. The header consists of metadata including the type of token and the hashing algorithm used to sign the token. The payload contains the claims data that the token is encoding. The final result looks like:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlIjoiSldUIFJ1bGVzISIsImlhdCI6MTQ1OTQ0ODExOSwiZXhwIjoxNDU5NDU0NTE5fQ.-yIVBD5b73C75osbmwwshQNRC7frWUYrqaTjTpza2y4

Authorization through POST Parameters

The Integration sends a POST request with following body parameters to the authorization server:

The authorization server will respond with a JSON object containing the following properties:

The access token is active for 15 minutes, up to a maximum of 120 minutes (2 hours). To avoid expiration, the access token must be used (by calling an API) at least once every 15 minutes. Active minutes and expiration duration are configurable based on the Integration requirements.