👮‍♂️How to Authenticate

The Lorum API uses OAuth2 client credentials to generate a bearer token (access_token). Tokens are valid for 3 hours - after that you'll need to request a new one.

❗️

Important: Correct token management is a mandatory requirement of every API integration. Integrations that generate a new token on every API call instead of caching and reusing it will not be certified, and the API will not be enabled in production until this is resolved.

curl --request POST \
     --url https://auth-sandbox.fuse.com/oauth/token \
     --header 'content-type: application/json' \
     --data '{
       "client_id": "<YOUR_CLIENT_ID>",
       "client_secret": "<YOUR_CLIENT_SECRET>",
       "audience": "https://api.lorum.com",
       "grant_type": "client_credentials"
     }'

Once you have a token, pass it as a Bearer token in the authorization header:

curl --request GET \
     --url https://api-sandbox.fuse.com/v1/accounts \
     --header 'accept: application/json' \
     --header 'authorization: Bearer <YOUR_ACCESS_TOKEN>'

Go to the auth endpoint documentation in our API reference.

🪙 Token Management

Cache and reuse tokens for their full 3-hour lifetime - don't request a new token on every API call. You can refresh the token shortly before it expires to avoid interruptions, but this isn't required; when and whether to refresh ahead of expiry is up to your integration.

Best Practices for JWT Caching:

• Secure Storage: Store the JWT in a secure component of your application, ensuring it’s accessible only by the components that require it for making API calls.
• Expiry Monitoring: Track the token's expiry time so you know when it's approaching, and refresh it before it expires - the exact timing is up to your integration.
• Automated Refresh: Handle token renewal in the background so it's transparent to the rest of your application.