Authentication

Base URLhttps://b2b.allaria.dev

Once your IP is whitelisted, use your client_id and client_secret to obtain an access token (access_token) that will allow you to make authenticated calls to the API.

POST/auth/token

Request

Headers

Field	Type	Required	Description
Content-Type	string	Yes	Must be application/x-www-form-urlencoded

Not applicable: Path Parameters, Query Parameters.

Body

Field	Type	Required	Description
client_id	string	Yes	Your client identifier provided by Allaria
client_secret	string	Yes	Your client secret (keep confidential)
grant_type	string	Yes	Must be: client_credentials

Response

2XX Success

Field	Type	Description
access_token	string	Token to authenticate subsequent requests
expires_in	integer	Time in seconds before the token expires (86400 seconds = 1 day)
refresh_expires_in	integer	Refresh token expiration time (0 = not applicable)
token_type	string	Token type (always Bearer)
not_before_policy	integer	Minimum token usage time policy
scope	string	Token permission scopes

Error Codes

Status	Error	Description
400	invalid_request	Missing or invalid parameters
401	invalid_client	Invalid client_id or client_secret
403	access_denied	Access denied to the API
500	server_error	Internal server error

Error response example:

{
  "error": "invalid_client",
  "error_description": "Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method)"
}

Code Example

cURL

curl -X POST https://b2b.allaria.cloud/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=TU_CLIENT_ID&client_secret=TU_CLIENT_SECRET&grant_type=client_credentials"

JavaScript

const response = await fetch('https://b2b.allaria.cloud/auth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    client_id: 'TU_CLIENT_ID',
    client_secret: 'TU_CLIENT_SECRET',
    grant_type: 'client_credentials'
  })
});
const data = await response.json();
console.log(data.access_token);

Python

import requests
response = requests.post(
  'https://b2b.allaria.cloud/auth/token',
  headers={'Content-Type': 'application/x-www-form-urlencoded'},
  data={
    'client_id': 'TU_CLIENT_ID',
    'client_secret': 'TU_CLIENT_SECRET',
    'grant_type': 'client_credentials'
  }
)
data = response.json()
access_token = data['access_token']

Node.js

const axios = require('axios');
const response = await axios.post('https://b2b.allaria.cloud/auth/token',
  new URLSearchParams({
    client_id: 'TU_CLIENT_ID',
    client_secret: 'TU_CLIENT_SECRET',
    grant_type: 'client_credentials'
  }),
  { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }
);
const accessToken = response.data.access_token;

2XX Success

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 86400,
  "refresh_expires_in": 0,
  "token_type": "Bearer",
  "not_before_policy": 0,
  "scope": ""
}

Using the Token in Requests

Once you have obtained the access_token, include it in the Authorization header of your requests:

cURL

curl -X GET https://b2b.allaria.cloud/v1/accounts \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json"

JavaScript

const accessToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...';
const response = await fetch('https://b2b.allaria.cloud/v1/accounts', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  }
});
const data = await response.json();

Python

import requests
access_token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
headers = {
  'Authorization': f'Bearer {access_token}',
  'Content-Type': 'application/json'
}
response = requests.get('https://b2b.allaria.cloud/v1/accounts', headers=headers)
data = response.json()

Security

Never expose your client_secret in client-side code. Always generate tokens on your backend server and send them securely to the client.