Skip to content

Token

The Configuration API uses the OAuth 2.0 Client Credentials grant.

Request API credentials from Retarus before calling the API. Keep the client secret and every access token confidential; do not commit them to source control or write them to application logs.

Generate an access token

Send a POST request to https://api-auth-service.eu.retarus.com/realms/platform/protocol/openid-connect/token with the content type application/x-www-form-urlencoded and these form fields:

FieldValue
grant_typeclient_credentials
client_idClient ID supplied by Retarus
client_secretClient secret supplied by Retarus

A successful response contains access_token, expires_in, token_type, and the granted scope. Use the access_token as an HTTP Bearer token for Configuration API requests:

Authorization: Bearer <ACCESS_TOKEN>

Access tokens are short-lived. Cache a token only until shortly before expires_in elapses, then request a new one with the same client credentials. A Client Credentials token is not renewed with an end-user refresh-token flow.