Get a token
Exchange your API credentials for a **token pair**: a 15-minute access token, and a 7-day refresh token that mints the next access token without re-sending your api key.
Credentials go in the `x-client-id` and `x-api-key` **headers** — there is no request body.
The service operator issues the client id and api key **once**; only a SHA-256 hash of the key is stored, so it cannot be recovered.
**Credentials are per environment.** You need one pair for sandbox and a separate pair for production; neither authenticates against the other.
## Use `/refresh`, not `/auth`, to stay logged in
Call `/auth` when you have no valid refresh token — at startup, or after a refresh has been rejected. Thereafter roll the pair forward with [`/refresh`](/api-reference/auth/refresh-token), which keeps your api key off the wire.
Authentication
x-client-idstring
API client id, issued by the service operator. Used only by /auth.
x-api-keystring
API key, issued by the service operator and shown once. Used only by /auth.
Headers
X-Request-Id
Correlation id. Generated if omitted, echoed on every response, and written to the audit log. /send is the exception — there it is required, and it doubles as the idempotency key.
Response
OK
result
requestId
Echo of the inbound X-Request-Id, or a generated one.
Errors
401
Unauthorized Error
403
Forbidden Error