Authentication

The Axiym API platform uses OAuth 2.0 client credentials. Exchange your partner credentials for a short-lived access token, then send it on protected requests.

The same token authorizes your organization's paths and the client paths available to your partnership. A client does not supply separate API credentials.

Request an access token

POST /oauth/token uses application/x-www-form-urlencoded. Do not send an Authorization header on this request.

curl --request POST \
  "https://partner-api.sandbox.axiym.io/api/v1/oauth/token" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "client_id=$AXIYM_CLIENT_ID" \
  --data-urlencode "client_secret=$AXIYM_CLIENT_SECRET" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "scope=$AXIYM_SCOPE"

Parameter	Value
`client_id`	OAuth client identifier issued by Axiym.
`client_secret`	OAuth client secret issued by Axiym.
`grant_type`	`client_credentials`.
`scope`	Space-delimited scopes required by the API and issued to your integration.

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "<requested_scope>",
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni..."
}

Authenticate API requests

GET /accounts HTTP/1.1
Authorization: Bearer <access_token>

Store client_secret server-side in an environment-specific secret store. Sandbox and production credentials are separate.

Track expires_in and obtain a new token before the current token expires. If a token is missing, expired, or invalid, request a new token and retry the original request once.

Request an access token

Authenticate API requests

On this page