---
title: Authentication
slug: devdocs/authentication
docTags: 
createdAt: 2026-10-16T12:03:50.700Z
---

The **Delivery API** uses a **Bearer token**. You get the token from one endpoint and send it with every GraphQL request.

The same token works for the **CRM & Loyalty API**. See **[Authentication Overview](docId\:J2FmZrijHggXl3Jouft5R)** in **Getting Started**.

## Get a token

`POST https://sandbox.expressoft.eu/connect/api/authentication/interop/token`

**Request body**

```json
{
  "applicationId": "CloudInteropApplication",
  "applicationVersion": "1.0.0.0",
  "languageCode": "en",
  "userName": "<your API user name>",
  "password": "<your API password>"
}
```

**cURL**

```bash
curl --location 'https://sandbox.expressoft.eu/connect/api/authentication/interop/token' \
--header 'Content-Type: application/json' \
--data '{"applicationId": "CloudInteropApplication", "applicationVersion": "1.0.0.0", "languageCode": "en", "userName": "<your API user name>", "password": "<your API password>"}'
```

**Response**

```json
{
  "token": "<bearer token>",
  "tokenExpireOn": "2026-01-15T18:30:00.0000000+03:00",
  "extension": {
    "apiURL": "https://sandbox.expressoft.eu/connect/api/interopgql"
  },
  "refreshToken": null,
  "versionInformation": null,
  "authenticationType": 0,
  "identity": null,
  "session": null,
  "errorCode": null,
  "errorMessage": null
}
```

| Field                       | Description                                                                                                                                                    |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `token`                     | The Bearer token.                                                                                                                                              |
| `tokenExpireOn`             | The expiration time of the token.                                                                                                                              |
| `extension.apiURL`          | The GraphQL endpoint to call. In sandbox it is [`https://sandbox.expressoft.eu/connect/api/interopgql`](https://sandbox.expressoft.eu/connect/api/interopgql). |
| `errorCode`, `errorMessage` | `null` on success. Filled in when authentication fails.                                                                                                        |

## Use the token

Add the token to the `Authorization` header of every GraphQL request:

```text
Authorization: Bearer <token>
```

## Renew the token

When a request returns **401**, get a new token with the request above, replace the stored one, and retry.

:::hint{type="info"}
Renew the token before `tokenExpireOn` instead of waiting for a 401.
:::

:::hint{type="warning"}
Keep the username, password, and token private. Never store them in client-side code or in a public repository.
:::