Authorization through POST Parameters

Password = [PASSWORD]

Username and password value used to authenticate incoming request. These values are defined in CLIENT API application for each integrator.

Authorization through Header

Instead of sending credentials in plain text through post parameters, an authenticated request includes the Authorization Header Variable. If this header is not included, the request is anonymous and may not succeed against API services.

To authenticate a request, you must encode the combined username and password in the request.

The format for the Authorization header is as follows:

Authorization: Basic [Encoded-Base64-String]

Constructing the Basic Authentication

Constructing Basic Authentication through headers involves encoding the username and password in a specific format and including them in the HTTPs request headers. Here's how you can do it:

Encode Credentials: Combine the username and password with a colon (:) separator, then base64 encodes the resulting string. The format is username:password.

Set the Authorization header of the HTTP request to the value "Basic” followed by the base64 encoded credentials.

The final header value should look like "Basic {base64_encoded_credentials}".

Example Request:
## Header:
Method: POST
Request URL: https://stage.avanzeapi.com/{modulename}/{orgcode}
Authorization: Basic {base64_encoded_credentials}
Content Type: application/xml or application/json
## Body:

Authorization through POST Parameters

Token-based authentication is a protocol which allows users to verify their identity, and in return receive a unique access token. During the life of the token, users then access the website or app that the token has been issued for, rather than having to re-enter credentials each time they go back to the same webpage, app, or any resource protected with that same token.

Auth tokens work like a stamped ticket. The user retains access as long as the token remains valid. Once the user logs out or quits an app, the token is invalidated.

Token-based authentication is different from traditional password-based or server-based authentication techniques. Tokens offer a second layer of security, and administrators have detailed control over each action and transaction.

Token Authentication in 4 Easy Steps:

Use a token-based authentication system, and visitors will verify credentials just once. In return, they'll get a token that allows access for a time period you define.

The process works like this:

Request: The person asks for access to a server or protected resource. That could involve a login with a password, or it could involve some other process you specify. Verification: The server determines that the person should have access. That could involve checking the password against the username, or it could involve another process you specify. Tokens: The server communicates with the authentication device, like a ring, key, phone, or similar device. After verification, the server issues a token and passes it to the user. Storage: The token sits within the user's browser while work continues.

If the user attempts to visit a different part of the server, the token communicates with the server again. Access is granted or denied based on the token.

Administrators set limits on tokens. You could allow a one-use token that is immediately destroyed when the person logs out. Or you could set the token to self-destruct at the end of a specified time period.

A JSON Web Token consists of three parts: Header, Payload and Signature. The header and payload are Base64 encoded, then concatenated by a period, finally the result is algorithmically signed producing a token in the form of header.claims.signature. The header consists of metadata including the type of token and the hashing algorithm used to sign the token. The payload contains the claims data that the token is encoding. The final result looks like:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJtZXNzYWdlIjoiSldUIFJ1bGVzISIsImlhdCI6MTQ1OTQ0ODExOSwiZXhwIjoxNDU5NDU0NTE5fQ.-yIVBD5b73C75osbmwwshQNRC7frWUYrqaTjTpza2y4

Authorization through POST Parameters

The Integration sends a POST request with following body parameters to the authorization server:

The authorization server will respond with a JSON object containing the following properties:

The access token is active for 15 minutes, up to a maximum of 120 minutes (2 hours). To avoid expiration, the access token must be used (by calling an API) at least once every 15 minutes. Active minutes and expiration duration are configurable based on the Integration requirements.