Skip to content

Authentication

An API token is required for each endpoint use. An API token can only be created after an account is created, registered, and at least one API key has been created.

The API token is required for each endpoint. It is an encrypted string that combines the client Id and client secret from an API key (created earlier). It contains authentication and authorization coding. This includes any privileges the user or account affords. Being encrypted means the API token is safe to expose in frontend code. The API token is time-sensitive and expires after an amount of time.

It may be created as needed. We recommend generating a new API token before each endpoint use. This ensures the API token will be valid for each call.

The API token is an OAuth 2.0 Client Credentials authorization flow. The Client Credentials Flow is an OAuth 2.0 authorization Bearer grant. This means a server-side application obtains an API token using its client credentials (client ID and client secret) to protect resources.

Operations

Authentication baseURLs

An API token is created for the environment it will be used in.

There are two available Flute environments: Sandbox and Production.

The sandbox and production environments API tokens use the same API key and differentiated only by the environment endpoint. The resulting API tokens are not interchangeable and cannot be used in an environment different than they were created for.

The API key that was created in the initial account registration is needed to create an API token. The client ID and client secret are used together to create an API token.

These authentication URLs are used with POST /oauth2/token.

Sandbox
Use the sandbox environment for development and testing. No payments, charges, or invoices will be enforced.
Endpoint: POST https://sandbox.oauth.api.flute.com

Production
Use the production environment for deploying the payment system live to clients. All payments, charges, or invoices will be enforced.
Endpoint: POST https://oauth.api.flute.com

The following is an example of obtaining an API token for the sandbox environment:

curl -X 'POST' 'https://sandbox.oauth.api.flute.com/oauth2/token' \
-u '594838709594...38697242c:9eb2c6859daa4...d8ae5da9' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=client_credentials&scope=offline_access'

The following is an example of refreshing an API token for the sandbox environment:

curl -X 'POST' 'https://sandbox.oauth.api.flute.com/oauth2/token' \
-u '594838709594...38697242c:9eb2c6859daa4...d8ae5da9' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token&refresh_token=def50200newrefresh123456789'

Regardless of either obtaining or refreshing an API token, the following example is passed back in the response body:

{
    "access_token": "u7BYwJx26U1lT...TZpKvndLCC4",
    "refresh_token": "def50200newrefresh123456789",
    "token_type": "Bearer",
    "expires_in": 900
}