Get a token
Exchange your API credentials for a token pair: a 15-minute access token, and a 7-day refresh token that mints the next access token without re-sending your api key.
Credentials go in the x-client-id and x-api-key headers — there is no request body.
The service operator issues the client id and api key once; only a SHA-256 hash of the key is stored, so it cannot be recovered.
Credentials are per environment. You need one pair for sandbox and a separate pair for production; neither authenticates against the other.
Use /refresh, not /auth, to stay logged in
Call /auth when you have no valid refresh token — at startup, or after a refresh has been rejected. Thereafter roll the pair forward with /refresh, which keeps your api key off the wire.
Authentication
API client id, issued by the service operator. Used only by /auth.
API key, issued by the service operator and shown once. Used only by /auth.
Headers
Correlation id. Generated if omitted, echoed on every response, and written to the audit log. /send is the exception — there it is required, and it doubles as the idempotency key.
Response
Echo of the inbound X-Request-Id, or a generated one.