Skip to main content

Authentication

SoshiaConnect API uses two authentication methods depending on your use case.

Bearer Token Authentication​

Bearer tokens are used for authenticated user endpoints. These tokens are obtained after successful user login.

How to Get a Bearer Token​

  1. Call the /auth/login endpoint with your credentials
  2. Receive an access token in the response
  3. Use this token in the Authorization header for subsequent requests

Example Request​

curl -X POST https://api.soshiaconnect.com/api/auth/login \
  -H "Content-Type: multipart/form-data" \
  -F "email=user@example.com" \
  -F "password=yourpassword"

Example Response​

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "user": {
    "id": 1,
    "email": "user@example.com",
    "full_name": "John Doe"
  }
}

Using the Bearer Token​

Include the token in the Authorization header:

curl https://api.soshiaconnect.com/api/auth/profile \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

API Key Authentication​

API keys are used for external API consumption and server-to-server communication.

How to Get an API Key​

  1. Log in to your SoshiaConnect account
  2. Navigate to API Keys section
  3. Click "Generate New API Key"
  4. Copy and securely store your API key

Using the API Key​

Include the API key in the request headers:

curl https://api.soshiaconnect.com/api/api-routes-data?id=123 \
  -H "X-API-Key: your_api_key_here" \
  -H "X-Username: your_username"

Security Best Practices​

  1. Never share your credentials or API keys
  2. Use HTTPS only - Never send credentials over HTTP
  3. Rotate API keys regularly - Generate new keys periodically
  4. Store securely - Use environment variables or secret management systems
  5. Monitor usage - Check your API usage logs regularly for suspicious activity
  6. Revoke compromised keys immediately - If you suspect a key has been compromised, revoke it right away

Token Expiration​

  • Bearer tokens expire after a certain period (typically 24 hours)
  • Use the /auth/refresh endpoint to refresh expired tokens
  • API keys don't expire but can be deactivated manually

Error Responses​

401 Unauthorized​

{
  "success": false,
  "message": "Invalid or missing authentication"
}

403 Forbidden​

{
  "success": false,
  "message": "Insufficient permissions"
}