Skip to main content

Authentication

The Attlaz API uses OAuth 2.0. Every request to a protected endpoint must include a Bearer access token:

Authorization: Bearer <access_token>

There are two ways to obtain a token: an OAuth client (for server-to-server integrations) or a personal access token (for scripts and manual use).

OAuth client credentials​

For a server-to-server integration, create an OAuth client to get a client_id and client_secret, then exchange them for an access token at the (unversioned) token endpoint:

curl -X POST https://api.attlaz.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=<client_id>" \
  -d "client_secret=<client_secret>"

The response contains an access_token you send as the Authorization: Bearer header. Tokens expire; when a token expires, request a new one (or use a refresh_token grant if you were issued a refresh token):

curl -X POST https://api.attlaz.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=<refresh_token>" \
  -d "client_id=<client_id>" \
  -d "client_secret=<client_secret>"

The official client libraries handle obtaining and refreshing tokens for you.

Personal access tokens​

A personal access token (PAT) is a long-lived token tied to your user, ideal for scripts, one-off tasks, and testing. Manage them under personal access tokens in the dashboard, or through the API:

  • GET /access-tokens — list your tokens.
  • POST /access-tokens — create a token. Provide a name, a set of scopes, and an expires_at.
  • POST /access-tokens/{id} — update a token's name. A token's scopes and expiry are fixed when it is created and cannot be changed afterwards; to change them, create a new token.
  • DELETE /access-tokens/{id} — revoke a token.

The token secret is shown once, at creation — copy it then, as it cannot be retrieved later. Expirations range from 7 days up to 2 years. Send the token exactly like any other access token:

curl https://api.attlaz.com/1.13/... \
  -H "Authorization: Bearer <personal_access_token>"

See Permissions & scopes for how a token's scopes and your project access determine what it can do.

Connecting adapters​

Connecting a third-party adapter (Magento 2, Google, and so on) uses a dedicated, browser-based OAuth flow rather than a token you pass yourself. Your integration first calls POST /app/{adapter}/prepare-connect (authenticated) to obtain a short-lived state code, then opens GET /app/{adapter}/connect?prepare_state=<code> to complete the connection.