Core Concepts

The Authentication API returns the access token that every other Direct Web Services API needs. This page introduces the key ideas, and links to the articles that explain each one in detail.

Credentials

You authenticate with your username and password, which are issued when your account is set up. The API uses HTTP Basic authentication, so you send them as a Base64-encoded username:password string in the Authorization header.

• Get an Access Token explains how to prepare your credentials.

Access Tokens

The API returns a signed JSON Web Token (JWT). You send it as a Bearer token in the Authorization header of every request to the other APIs. The response also tells you the token type and how many seconds the token is valid for.

• Get an Access Token explains the response.

Token Lifetime

A token is valid for 60 minutes, and can be reused for any number of requests during that time. If you request a new token within 10 minutes of generating one, the API returns the same token. When a token expires, the API returns an error, and you request a new one.

• Manage Tokens explains how to reuse, track and refresh tokens.

Regions

The token endpoint is available in each region. Use the base URL for your region, and the same region for the requests that you make with the token.

• Get an Access Token lists the base URLs.