Skip to main content

Authentication

The Craft API uses OAuth 2.0. Craft Identity issues the access token. Send the token as a bearer token on every GraphQL request.

Steps​

  1. Request client credentials from Craft. You receive a client ID and a client secret.
  2. Exchange the credentials for an access token at the Craft Identity token endpoint.
  3. Send the token in the Authorization header of each GraphQL request.
  4. Refresh the token before it expires. The token response contains the lifetime in expires_in.

Sample request​

curl -X POST https://auth-api.craft.co/oidc/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "resource=https://api.craft.co"

Sample response​

{
  "access_token": "<jwt>",
  "token_type": "Bearer",
  "expires_in": 3600
}

Next call: use access_token as the bearer token on every GraphQL request.

curl -X POST https://api.craft.co/beta/graphql \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ company(id: \"<company-id>\") { id name } }"}'

Error example​

A missing or expired token returns HTTP 401. A token without access to the requested data returns an error in the top-level errors array. See Errors.

{
  "errors": [{ "message": "Unauthorized" }]
}