Authentication

All Shoplogix API requests require an OAuth 2.0 Bearer token. The token must be included in every request:

Authorization: Bearer <your-token>

Tokens are obtained by calling POST /auth/token with your API credentials. Two grant flows are supported depending on your use case.

---

Getting API Credentials

Before you can request a token, you need a client ID and client secret.

1. Log into Shoplogix IMS
2. Go to Developer Tools → API Credentials (requires the Developer role)
3. Generate a new credential set — you will receive a client_id and client_secret

See API Credentials for step-by-step instructions on creating, rotating, and managing credentials.

---

Token Endpoint

POST /auth/token
Content-Type: application/x-www-form-urlencoded

The request body must be form-encoded (not JSON).

---

Client Credentials Flow

Use this flow for machine-to-machine integrations: automated scripts, server-side pipelines, and any integration that runs without a user session. This is the recommended approach for production integrations.

Request

curl -X POST https://api.data.everactive.com/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400
}

Field	Type	Description
access_token	string	The Bearer token to include in subsequent API requests
token_type	string	Always "Bearer"
expires_in	number	Seconds until the token expires

Use the access_token value as-is in the Authorization header of every subsequent request.

---

Resource Owner Password Flow

Use this flow for testing or user-context calls where you need to authenticate as a specific user. This is not recommended for production integrations — use Client Credentials instead.

Request

curl -X POST https://api.data.everactive.com/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "username=user@example.com" \
  -d "password=YOUR_PASSWORD"

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "a4f8e2b1-1234-5678-abcd-ef9012345678"
}

The password flow may return a refresh_token that can be used to obtain a new access token without re-authenticating (see below).

---

Refresh Tokens

If your token response includes a refresh_token, you can exchange it for a new access token without providing your credentials again.

Request

curl -X POST https://api.data.everactive.com/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "refresh_token=YOUR_REFRESH_TOKEN"

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "b5a9f3c2-2345-6789-bcde-f01234567890"
}

A new refresh_token is issued with each refresh response. Discard the old one.

---

Handling Token Expiry

Tokens expire after the number of seconds indicated by expires_in. When a token expires, the API returns 401 Unauthorized.

Your integration must handle this by:

1. Catching 401 responses
2. Re-authenticating to obtain a new token
3. Retrying the original request with the new token

For Client Credentials integrations, simply re-issue the POST /auth/token request with your credentials. The platform caches tokens internally — repeated calls within the token's validity window return the cached token without issuing a new one.

---

Security

• Never embed client_secret values in client-side code, mobile apps, or public repositories.
• Store credentials in environment variables or a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager).
• Rotate credentials periodically from the API Credentials page in Insights.
• Credentials can have an effective start and end date — expired credentials return 401 immediately.