Authentication

1. Request a bearer token

Send your credentials to POST /auth/token. Full schema in the API Reference.

curl -X POST BASEURL/auth/token \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "prm_live_8f3c2a1b",
    "client_secret": "prm_secret_d4e5f6a7b8c9"
  }'

const res = await fetch('BASEURL/auth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    client_id: 'prm_live_8f3c2a1b',
    client_secret: 'prm_secret_d4e5f6a7b8c9',
  }),
})
const { access_token } = await res.json()

A successful call returns 201 Created with the token:

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

📘

The response contains only access_token

There is no token_type or expires_in field. The token is a short-lived JWT — request a new one when a call starts returning 401 (see §4).

3. Authenticate your requests

Send the token in the Authorization header as a Bearer token on every subsequent request:

curl BASEURL/users/list \
  -H 'Authorization: Bearer <access_token>'

await fetch('BASEURL/users/list', {
  headers: { Authorization: `Bearer ${access_token}` },
})

4. Token lifetime & errors

Tokens are short-lived. When a request returns 401 Unauthorized, request a fresh token from POST /auth/token and retry the call.

Invalid credentials return 401:

{
  "message": "Invalid api credentials"
}

🚧

Keep credentials and tokens server-side

Never embed your client secret or bearer tokens in browser or mobile clients. Always request tokens from a backend you control.

Next steps

• Create a trip via the API — the end-to-end happy path that starts from the token you just obtained.