Authentication

The Noyax API uses JWT access tokens. You get a token from the Noyax auth service with your API key and send it in the Authorization header of every request.

Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImFwaSIs...

Flow

Getting a token

string

required

Your organization name, issued by Noyax.

string

required

Your API key.

curl -X POST https://app.noyax.com/services/bb_auth_service/api/ApiAuth/login \
  -H "Content-Type: application/json" \
  -d '{ "OrgName": "YOUR_ORG_NAME", "ApiKey": "YOUR_API_KEY" }'

{
  "Data": {
    "AccessToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImFwaSIs...",
    "RefreshToken": "q3Jv1mYt8Rk0bXw2LzH5nD7sPfA9cGe4..."
  },
  "Success": true,
  "Message": null
}

If the credentials are wrong or your API license has expired, the auth service returns 401 (Invalid API credentials., ApiKey expired.).

Refreshing a token

Access tokens are short-lived (a matter of minutes). When a token expires, the API responds with:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token", error_description="The token expired"

{
  "Success": false,
  "ResultCode": "0102",
  "Message": "Token has expired. Obtain a new token using the refresh token.",
  "Errors": [
    { "Code": "0102", "Message": "Token has expired. Obtain a new token using the refresh token." }
  ]
}

Get a new pair with the old access token and the refresh token:

curl -X POST https://app.noyax.com/services/bb_auth_service/api/ApiAuth/refresh \
  -H "Content-Type: application/json" \
  -d '{ "AccessToken": "EXPIRED_TOKEN", "RefreshToken": "REFRESH_TOKEN" }'

The response has the same shape as the login response.

Every login and refresh issues a new refresh token and invalidates the previous one. An API key has only one valid refresh token at a time. If several servers or processes use the same key, manage the token in one place and share it. Otherwise a refresh in one process invalidates the refresh token of the others.

Recommended practice

Keep the token in memory or in a shared cache. Do not log in for every request.
Refresh shortly before the token’s exp claim, or refresh once when you get 401 invalid_token and retry the request.
If refreshing fails (Invalid refresh token.), log in again.

Token contents

The access token carries the settings of your API key, captured when the token is issued:

Claim	Meaning
`P`	Module permissions. See Permissions
`ARC`	Daily request limit. See Rate limits
`exp`	Token expiry (Unix time)

If the permissions or daily limit of your key change, the change takes effect when you get a new token.

Getting started

Core concepts

Modules

Release notes

Flow

Getting a token

Refreshing a token

Recommended practice

Token contents

​Flow

​Getting a token

​Refreshing a token

​Recommended practice

​Token contents

Flow

Getting a token

Refreshing a token

Recommended practice

Token contents