Authentication & Tokens

As mentioned in the getting started section, there are 2 ways of authenticating with the REST API:

1. User Authorization Token (UAT), created from the portal. We advise using this method as it gives you direct access to the endpoint without having to login first. It also allows for finer-grained access control and can more easily be revoked for testing-purposes.
2. Username/password credentials, as provided at signup (which results in a JWT token to be used in the HTTP header)

When using the UAT token, it will act on behalf of the user with ONLY the assigned access permissions assigned to the token when it was created. This limits what the token can do and is considered more secure. When using the JWT token, the logged-in session has ALL the rights of that user and as such can access any API to which it has access, so it is highly advised to only use a user with limited permissions.

To test if access is working, you can access GET https://api.staging.scantrust.io/api/v2/me/

Obtaining a User Authorization Token (UAT)

1. Log on to the Enterprise Portal as a company admin
2. Trom the left hamburger menu, click on your user name (below the heading me)

3. Click the PLUS icon next to USER AUTHORIZATION TOKENS

4. Select the date until which this token is valid
5. Select the access rights you would like to give to this token. Below are the available permissions:
   • brand_create
   • product_create
   • scans_download
   • scm_bulk_edit
   • scm_code_edit

Using the UAT token

With the UAT token, instead of having to request a JWT token first, the UAT token obtained from the portal can be directly used in the header:

POST HEADER: "Authorization": "UAT {token value}"

---

Obtaining a JWT token

In order to call private API endpoints with a JSON web token (JWT), it needs to be included in the POST header. Therefore it is required to call an endpoint to login first. On a successful call, the API will respond with a JWT token to use in future API calls.

The JWT is then sent in the request header as follows:

headers={"Authorization": "JWT " + token}

POST: /api/v2/auth/jwt/

Log in a user and return a JSON Web Token (JWT).

Attribute	Required?	Description
email	required	The email address of the Brand Admin/SCM User to log in
password	required	The password of the user

Body Parameters POST (application/json):

{
    "email": "user@example.com", 
 "password": "p@sSw0rd"
}

Response (200): Status OK

When the user has successfully logged in following response will be presented:

{
    "token": "example_web_token"
}

Response (400): Invalid user or password

Response when the user is unable to login:

{
        "non_field_errors": [
                "Unable to login with provided credentials."
        ]
    }