Authentication

The Cogo Transaction API uses the OAuth 2.0 protocol for authentication and authorization.

To begin, obtain OAuth 2.0 client credentials from Cogo. Then your client application requests an access token from the Cogo Authorization Server, extracts a token from the response, and sends the token to the Cogo Transaction API.

Obtain OAuth 2.0 credentials from Cogo

Cogo will supply you with a client ID and client secret.

Obtain an access token from the Cogo Authorization Server

Use your unique endpoint. Example: https://[unique].auth.cogo.co/oauth2/token

Note: the endpoint only supports HTTPS POST.

Authorization

The client must pass its client_id and client_secret in the authorization header through Basic HTTP authorization. The secret is Basic Base64Encode(client_id:client_secret).

Content-Type

The content-type header must always be 'application/x-www-form-urlencoded'.

grant_type

The grant type must be client_credentials.

Example request

The examples below demonstrates how to use your base64-encoded client credentials to obtain an access token with cURL:

curl --request POST \
  --url https://[unique].auth.cogo.co/oauth2/token \
  --header 'content-type: application/x-www-form-urlencoded'\
  --header 'Authorization: Basic aSdxd892iujendek328uedg' \
  --data 'grant_type=client_credentials'

Example response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IlBKRl8xRmFNcWVfcFoydDZPZUVWYyJ9.eyJpc3MiOiJodHRwczovL2NvZ28uZXUuYXV0aDAuY29tLyIsInN1YiI6ImFpMlFDR25IS3RwNlF5WVBkUTMwYXZ2UzF3QjJsNDBOQGNsaWVudHMiLCJhdWQiOiJodHRwczovL2FwaS5jb2dvLmNvIiwiaWF0IjoxNjEyNDEzOTk1LCJleHAiOjE2MTI1MDAzOTUsImF6cCI6ImFpMlFDR25IS3RwNlF5WVBkUTMwYXZ2UzF3QjJsNDBOIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.CwuFJ2h83-qSPDZuzxB9EA04m4blJvmiqDLJarTMW4q4Ac2j1t64bhmjcvwASGN48rgifVbUEn4H72s7BiULoSSMgMia3xIGdpaOxK7JGzNktG86cfSxJYJiRHWLBChPPkB5SF4SzWpT75_CIZTANuE9kcF69GplVi6o9pld_8LAGiOIGmO8I6RHCH-9qu9Y6LunbvEjLs78A8yYg1C_do8tnbf6oLMjUYe3mHNJRmdaOH0bMJN_vuu7dXX5BTN9TPnPG1Kk13JSGCp9P-dN98-O0RtMM0lPSNPu9kbf1El5xFHAWw8uVe1B9HpjlRf8wwcamwiWmSsmb5I_fwqkDQ",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Now that the application has an access_token, it is now able to make authorized calls to the API.

You can use this bearer token with an Authorization Header in your request to obtain authorized access to our API.

Access tokens will expire after 1 hour.

All API requests must be made over HTTPS. Calls made over plain HTTP will fail. API requests without authentication will also fail.