Authentication Overview
The APIs use Bearer token authentication. You request a token once, then send it with every GraphQL request. Basic authentication isn't supported.
One token works for the Delivery API and for the CRM & Loyalty API.
Step 1: Get a token
POST https://sandbox.expressoft.eu/connect/api/authentication/interop/token
Send the request as JSON. No Authorization header is needed for this call.
Request body
{
"applicationId": "CloudInteropApplication",
"applicationVersion": "1.0.0.0",
"languageCode": "en",
"userName": "<your API user name>",
"password": "<your API password>"
}Field | Description |
|---|---|
applicationId | Always CloudInteropApplication. |
applicationVersion | The version of your application. The examples use 1.0.0.0. |
languageCode | The language of the texts. Use en for English or ro for Romanian. |
userName, password | The credentials issued by Expressoft. |
cURL
curl --location 'https://sandbox.expressoft.eu/connect/api/authentication/interop/token' \
--header 'Content-Type: application/json' \
--data '{"applicationId": "CloudInteropApplication", "applicationVersion": "1.0.0.0", "languageCode": "en", "userName": "<your API user name>", "password": "<your API password>"}'Response
{
"token": "<bearer token>",
"tokenExpireOn": "2026-01-15T18:30:00.0000000+03:00",
"extension": {
"apiURL": "https://sandbox.expressoft.eu/connect/api/interopgql"
},
"refreshToken": null,
"versionInformation": null,
"authenticationType": 0,
"identity": null,
"session": null,
"errorCode": null,
"errorMessage": null
}Field | Description |
|---|---|
token | The Bearer token. |
tokenExpireOn | When the token expires. Check this value instead of assuming a fixed lifetime. |
extension.apiURL | The GraphQL endpoint of the environment. In sandbox it is https://sandbox.expressoft.eu/connect/api/interopgql. |
errorCode, errorMessage | Filled in when authentication fails. They are null on success. |
The other fields (refreshToken, versionInformation, authenticationType, identity, session) were returned as null or 0 in sandbox responses.
Step 2: Send the token with every request
Authorization: Bearer <token>Step 3: Renew the token
When a request returns 401, the token is missing, expired, or malformed:
- Repeat Step 1.
- Replace the stored token.
- Retry the failed request.
Renew the token shortly before tokenExpireOn instead of waiting for a 401. This avoids intermittent failures.