# Authentication

## Step 1: Authorization Link

This API used for authorization (login) process.

{% tabs %}
{% tab title="Request" %}

| Canonical Path | /rest/h2h/authorization/ |
| -------------- | ------------------------ |
| Method         | POST                     |
| Query Param    | -                        |
| Content-Type   | application/json         |
| Content        |                          |

<pre class="language-json" data-overflow="wrap"><code class="lang-json">{
    “client_id”: &#x3C;String, not null>, 
<strong>    “client_secret”: &#x3C;String, not null>, 
</strong><strong>    “response_type”: “code”, 
</strong><strong>    “user_type”: &#x3C;String, not null>, 
</strong><strong>    “username”: &#x3C;String, not null>, 
</strong><strong>    “password”: &#x3C;String, not null>
</strong>}

</code></pre>

{% endtab %}

{% tab title="Response" %}

| Content-Type | application/json |
| ------------ | ---------------- |
| Content      |                  |

{% code overflow="wrap" %}

```json
{
    "status": <string, not null>, 
    "code": <String, not null
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

## Description

| Field          | Description                                                                        |
| -------------- | ---------------------------------------------------------------------------------- |
| client\_id     | Public identifier of the client                                                    |
| client\_secret | Client Secret Key                                                                  |
| response\_type | The value "code"specify that an application is requesting authorization code grant |
| user\_type     | User type: CUSTOMER or MERCHANT                                                    |
| username       | Username for Login (using phone number)                                            |
| password       | Login Password/PIN (must be hashed using MD5 UPPERCASE)                            |

## **Step 2 : Request Access Token**

Using the authorization code from step 1 the client application can request the access token that can be used to access the API.

{% tabs %}
{% tab title="Request" %}

| Canonical Path | /rest/oauth/token                                                                                                                                  |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method         | POST                                                                                                                                               |
| Query Param    | -                                                                                                                                                  |
| Content-Type   | application/x-www-form-urlencoded                                                                                                                  |
| Content        | <p>▪client\_id=\<String>,</p><p>▪client\_secret=\<String></p><p>▪grant\_type=authorization\_code</p><p>▪code=\<String> redirect\_uri=\<String></p> |
| {% endtab %}   |                                                                                                                                                    |

{% tab title="Response" %}

| Content-Type | application/json |
| ------------ | ---------------- |

{% code overflow="wrap" %}

```json
{
    "access_token": <String>, 
    "token_type": <String>, 
    "expires_in": <String>, 
    "refresh_token": <String>,
    "scope": <String>
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

## Description

| Field          | Description                                                                                       |
| -------------- | ------------------------------------------------------------------------------------------------- |
| client\_id     | Public identifier of the client                                                                   |
| client\_secret | Secret key of the client                                                                          |
| grant\_type    | Type of grant: authorization\_code                                                                |
| code           | Authorization code                                                                                |
| redirect\_uri  | Redirection endpoint where the service redirect user-agent after an authorization code is granted |
| access\_token  | User access token as requested                                                                    |
| token\_type    | The type of token: Bearer                                                                         |
| expires\_in    | The lifetime in seconds of the access token                                                       |
| refresh\_token | Token that can be used to obtain new access token using the same authorization grant              |
| scope          | The scope of the access token                                                                     |

## Step 3 : Client Host Authorization

This API is used to authorize the host of client to access client resources. The flow of this process is based on OAuth client credentials to get access token. The access token then can be used to request the respected resource API.

{% tabs %}
{% tab title="Request" %}

| Canonical Path | rest/oauth/token                                                                                                            |
| -------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Method         | POST                                                                                                                        |
| Query Param    | -                                                                                                                           |
| Content-Type   | application/x-www-form-urlencoded                                                                                           |
| Content        | <p>▪        client\_id=\<String></p><p>▪        client\_secret=\<String></p><p>▪        grant\_type=client\_credentials</p> |
| {% endtab %}   |                                                                                                                             |

{% tab title="Response" %}

| Content-Type | application/json |
| ------------ | ---------------- |
| Content      |                  |

{% code overflow="wrap" %}

```json
{
    "access_token": <String>, 
    "token_type": <String>, 
    "expires_in": <String>, 
    "refresh_token": <String>, 
    "scope": <String>
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

## Description

| Field          | Description                                                                                          |
| -------------- | ---------------------------------------------------------------------------------------------------- |
| client\_id     | Public identifier of the client                                                                      |
| client\_secret | Secret key of the client                                                                             |
| grant\_type    | Type of grant: client\_credentials                                                                   |
| access\_token  | Host access token as requested                                                                       |
| token\_type    | The type of token: Bearer                                                                            |
| expires\_in    | The lifetime in seconds of the access token                                                          |
| refresh\_token | Token that can be used to obtain new access token using the same authorization grant (never expired) |
| scope          | The scope of the access token                                                                        |

## Step 4 : Refresh Token

This API is used to refresh access\_token before or after access\_token expires as long the refresh\_token is still valid.

{% tabs %}
{% tab title="Request" %}

| Canonical Path | /rest/oauth/token                                                                                                                                                                                             |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method         | POST                                                                                                                                                                                                          |
| Query Param    | -                                                                                                                                                                                                             |
| Content-Type   | application/x-www-form-urlencoded                                                                                                                                                                             |
| Content        | <p>▪        client\_id=\<String></p><p>▪        client\_secret=\<String></p><p>▪        grant\_type=refresh\_token</p><p>▪        refresh\_token=\<refresh\_token></p><p>▪        redirect\_uri=\<String></p> |
| {% endtab %}   |                                                                                                                                                                                                               |

{% tab title="Response" %}

| Content-Type | application/json |
| ------------ | ---------------- |
| Content      |                  |

{% code overflow="wrap" %}

```json
{
    "access_token": <String>, 
    "token_type": <String>, 
    "expires_in": <String>, 
    "scope": <String>
}
```

{% endcode %}
{% endtab %}
{% endtabs %}

## Description

| Field          | Description                                                                                          |
| -------------- | ---------------------------------------------------------------------------------------------------- |
| client\_id     | Public identifier of the client                                                                      |
| client\_secret | Secret key of the client                                                                             |
| grant\_type    | Type of grant: refresh\_token                                                                        |
| access\_token  | Host access token as requested                                                                       |
| token\_type    | The type of token: Bearer                                                                            |
| expires\_in    | The lifetime in seconds of the access token                                                          |
| refresh\_token | Token that can be used to obtain new access token using the same authorization grant (never expired) |
| scope          | The scope of the access token                                                                        |