Bearer Token Authentication

Getting the Access Token

To get the access token to authenticate the requests to our APIs, the client should make a POST request to the endpoint /service/health-analysis/accounts/user/openid/token/, using the application/x-www-form-urlencoded format, with the following data in the request body:

client_id: <value provided for each client>
client_secret: <value provided for each client>
grant_type: client_credentials

If the request is successful, the response will contain an access_request property with the token that allows access to the resources in the APIs.

The token provided will be valid for 2 days from the moment it is issued. You can reuse the same token to make API requests until it expires.

📘

Rate Limit

For the access token endpoint, we have a tighter rate limit than the standard one stated here.

The rate limit for /service/health-analysis/accounts/user/openid/token/ is 5 requests per IP address in a period of 2 minutes.

Using the Access Token

With the token obtained in the previous step, you can authenticate each request to the resources in the APIs, passing that token in the header like this:

Authorization: Bearer <token_from_previous_step>

Examples

Python

Getting the Token

Python

import os
import requests

# Get client ID and secret from the environment variables
client_id = os.getenv("CLIENT_ID")
client_secret = os.getenv("CLIENT_SECRET")

# Setup token URL
env_domain = os.getenv("SD_ENV")  # "qa-b2b." for testing, "" for prod
auth_url = f"https://{env_domain}selfdecode.com/service/health-analysis/accounts/user/openid/token/"

data = {
    "client_id": client_id,
    "client_secret": client_secret,
    "grant_type": "client_credentials",
}

token_headers = {"Content-Type": "application/x-www-form-urlencoded"}

auth_response = requests.post(
    auth_url,
    data=data,
    headers=token_headers,
)

if auth_response.status_code != 200:
    # Something failed getting the token
    print(auth_response.text)

access_token = auth_response.json().get("access_token")

Passing the Token to Fetch Profiles

Python

profiles_url = f"https://{env_domain}selfdecode.com/service/b2b-integrations/profile/"
auth_string = f"Bearer {access_token}"  # access_token from previous step

headers = {
    "Content-Type": "application/json",
    "Authorization": auth_string,
}

profiles_response = requests.get(
    profiles_url,
    headers=headers,
)

print(profiles_response.json())

cURL

Getting the Token

cURL

curl -X POST https://"$SD_ENV"selfdecode.com/service/health-analysis/accounts/user/openid/token/ \
  -d "client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&grant_type=client_credentials"

Get the access_token from the response

Passing the Token to Fetch Profiles

cURL

curl https://"$SD_ENV"selfdecode.com/service/b2b-integrations/profile/ \
  --header "Authorization: Bearer $ACCESS_TOKEN" \
  --header "Content-Type: application/json"