---
title: Authentication Overview
slug: devdocs/authentication-overview
docTags: 
createdAt: 2026-10-16T12:03:50.667Z
---

The APIs use **Bearer token authentication**. You request a token once, then send it with every GraphQL request. Basic authentication isn't supported.

One token works for the **Delivery API** and for the **CRM & Loyalty API**.

## Step 1: Get a token

`POST https://sandbox.expressoft.eu/connect/api/authentication/interop/token`

Send the request as JSON. No `Authorization` header is needed for this call.

**Request body**

```json
{
  "applicationId": "CloudInteropApplication",
  "applicationVersion": "1.0.0.0",
  "languageCode": "en",
  "userName": "<your API user name>",
  "password": "<your API password>"
}
```

| **Field**              | **Description**                                                       |
| ---------------------- | --------------------------------------------------------------------- |
| `applicationId`        | Always `CloudInteropApplication`.                                     |
| `applicationVersion`   | The version of your application. The examples use `1.0.0.0`.          |
| `languageCode`         | The language of the texts. Use `en` for English or `ro` for Romanian. |
| `userName`, `password` | The credentials issued by Expressoft.                                 |

**cURL**

```bash
curl --location 'https://sandbox.expressoft.eu/connect/api/authentication/interop/token' \
--header 'Content-Type: application/json' \
--data '{"applicationId": "CloudInteropApplication", "applicationVersion": "1.0.0.0", "languageCode": "en", "userName": "<your API user name>", "password": "<your API password>"}'
```

**Response**

```json
{
  "token": "<bearer token>",
  "tokenExpireOn": "2026-01-15T18:30:00.0000000+03:00",
  "extension": {
    "apiURL": "https://sandbox.expressoft.eu/connect/api/interopgql"
  },
  "refreshToken": null,
  "versionInformation": null,
  "authenticationType": 0,
  "identity": null,
  "session": null,
  "errorCode": null,
  "errorMessage": null
}
```

| **Field**                   | **Description**                                                                                                   |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| `token`                     | The Bearer token.                                                                                                 |
| `tokenExpireOn`             | When the token expires. Check this value instead of assuming a fixed lifetime.                                    |
| `extension.apiURL`          | The GraphQL endpoint of the environment. In sandbox it is `https://sandbox.expressoft.eu/connect/api/interopgql`. |
| `errorCode`, `errorMessage` | Filled in when authentication fails. They are `null` on success.                                                  |

The other fields (`refreshToken`, `versionInformation`, `authenticationType`, `identity`, `session`) were returned as `null` or `0` in sandbox responses.

## Step 2: Send the token with every request

```text
Authorization: Bearer <token>
```

## Step 3: Renew the token

When a request returns **401**, the token is missing, expired, or malformed:

1. Repeat Step 1.
2. Replace the stored token.
3. Retry the failed request.

:::hint{type="info"}
Renew the token shortly before `tokenExpireOn` instead of waiting for a **401**. This avoids intermittent failures.
:::