Authentication
The Delivery API uses a Bearer token. You get the token from one endpoint and send it with every GraphQL request.
The same token works for the CRM & Loyalty API. See Authentication OverviewAuthentication Overview in Getting Started.
Get a token
POST https://sandbox.expressoft.eu/connect/api/authentication/interop/token
Request body
{
"applicationId": "CloudInteropApplication",
"applicationVersion": "1.0.0.0",
"languageCode": "en",
"userName": "<your API user name>",
"password": "<your API password>"
}cURL
curl --location 'https://sandbox.expressoft.eu/connect/api/authentication/interop/token' \
--header 'Content-Type: application/json' \
--data '{"applicationId": "CloudInteropApplication", "applicationVersion": "1.0.0.0", "languageCode": "en", "userName": "<your API user name>", "password": "<your API password>"}'Response
{
"token": "<bearer token>",
"tokenExpireOn": "2026-01-15T18:30:00.0000000+03:00",
"extension": {
"apiURL": "https://sandbox.expressoft.eu/connect/api/interopgql"
},
"refreshToken": null,
"versionInformation": null,
"authenticationType": 0,
"identity": null,
"session": null,
"errorCode": null,
"errorMessage": null
}Field | Description |
|---|---|
token | The Bearer token. |
tokenExpireOn | The expiration time of the token. |
extension.apiURL | The GraphQL endpoint to call. In sandbox it is https://sandbox.expressoft.eu/connect/api/interopgql. |
errorCode, errorMessage | null on success. Filled in when authentication fails. |
Use the token
Add the token to the Authorization header of every GraphQL request:
Authorization: Bearer <token>Renew the token
When a request returns 401, get a new token with the request above, replace the stored one, and retry.
Renew the token before tokenExpireOn instead of waiting for a 401.
Keep the username, password, and token private. Never store them in client-side code or in a public repository.