This article is for developers and technical teams calling the Axeptio API directly — from code, a script, a custom integration, or an HTTP client like Postman.

Axeptio authenticates your requests using a short-lived Bearer token. You first generate a personal token in Axeptio administration, which provides you with a client ID and secret key. You then exchange these credentials for an access_token valid for 1 hour, which you include in each of your requests.

How authentication works

Generate a personal token in Axeptio administration. You receive a client ID and secret key that identify your integration.
Obtain an access token by presenting this client ID and secret key. You receive an access_token valid for 1 hour and a refresh_token.
Send your requests to the Axeptio API by including the access_token in the Authorization: Bearer header of each one.
Refresh the access token before it expires, without needing to re-enter the client ID and secret key.

Two distinct lifespans apply. The personal token — the client ID and secret key — has the expiration duration you choose when creating it: this is your long-lived credential. The access_token obtained from this token expires after one hour: this is what your code must automatically refresh.

1. Generate a personal token in Axeptio administration

Log in to Axeptio administration.
In the navigation bar, click Account.
Click Security Preferences — a window opens.
In the menu, select Personal Tokens.
Click Generate Token, give your token a name, and choose an expiration duration. We recommend avoiding the Never option: a token that never expires remains valid indefinitely if leaked. If you're unsure what to choose, opt for 90 days for a production integration, or 7 days for occasional use or testing.
Copy the Client ID and Secret Key that appear — they will no longer be visible after this step.

Keep the client ID and secret key in a safe place — they cannot be retrieved after generation. Never hardcode them into your code: store them in environment variables.

You can generate as many tokens as needed — the name allows you to identify them. This is useful if you have multiple environments (development, production) or multiple integrations: each token is independent, allowing you to revoke access for one specific integration without affecting others.

2. Obtain an access token

Call the authentication endpoint with your client ID and secret key. You receive an access_token, valid for 1 hour, and a refresh_token to renew it.

curl -X POST https://login.axept.io/identity/resources/auth/v2/api-token \
  -H "Content-Type: application/json" \
  -d '{ "clientId": "<CLIENT_ID>", "secret": "<SECRET>" }'

Response:

{
  "access_token": "eyJ...",
  "refresh_token": "dGhp...",
  "expires_in": 3600
}

3. Send your requests to the Axeptio API

Include the access_token in the Authorization header of each request.

curl https://api.axept.io/v1/<ENDPOINT> \
  -H "Authorization: Bearer <ACCESS_TOKEN>"

4. Refresh the access token before it expires

The access_token expires after 1 hour. Before each request, check if it is still valid and refresh it if necessary — without needing to re-enter the client ID and secret key.

curl -X POST https://login.axept.io/identity/resources/auth/v2/api-token/token/refresh \
  -H "Content-Type: application/json" \
  -d '{ "refreshToken": "<REFRESH_TOKEN>" }'

Complete code examples

TypeScript / Node.js

const AUTH_URL = "https://login.axept.io";
const AXEPTIO_API = "https://api.axept.io/v1";

interface TokenResponse {
  access_token: string;
  refresh_token: string;
  expires_in: number;
}

async function getAccessToken(clientId: string, secret: string): Promise<TokenResponse> {
  const res = await fetch(`${AUTH_URL}/identity/resources/auth/v2/api-token`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ clientId, secret }),
  });
  if (!res.ok) throw new Error(`Token fetch failed: ${res.status}`);
  return res.json();
}

async function refreshAccessToken(refreshToken: string): Promise<TokenResponse> {
  const res = await fetch(`${AUTH_URL}/identity/resources/auth/v2/api-token/token/refresh`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ refreshToken }),
  });
  if (!res.ok) throw new Error(`Token refresh failed: ${res.status}`);
  return res.json();
}

async function callAxeptioApi(accessToken: string, path: string) {
  const res = await fetch(`${AXEPTIO_API}${path}`, {
    headers: { Authorization: `Bearer ${accessToken}` },
  });
  if (!res.ok) throw new Error(`API call failed: ${res.status}`);
  return res.json();
}

// Usage with automatic refresh
let token = await getAccessToken(CLIENT_ID, SECRET);

let expiresAt = Date.now() + token.expires_in * 1000;

async function apiCall(path: string) {
  // Refreshes 60 s before expiration to avoid rejections due to network latency
  if (Date.now() > expiresAt - 60_000) {
    token = await refreshAccessToken(token.refresh_token);
    expiresAt = Date.now() + token.expires_in * 1000;
  }
  return callAxeptioApi(token.access_token, path);
}

Python

import time
import requests

AUTH_URL = "https://login.axept.io"
AXEPTIO_API = "https://api.axept.io/v1"

def get_access_token(client_id: str, secret: str) -> dict:
    res = requests.post(
        f"{AUTH_URL}/identity/resources/auth/v2/api-token",
        json={"clientId": client_id, "secret": secret},
    )
    res.raise_for_status()
    return res.json()

def refresh_access_token(refresh_token: str) -> dict:
    res = requests.post(
        f"{AUTH_URL}/identity/resources/auth/v2/api-token/token/refresh",
        json={"refreshToken": refresh_token},
    )
    res.raise_for_status()
    return res.json()

def call_axeptio_api(access_token: str, path: str) -> dict:
    res = requests.get(
        f"{AXEPTIO_API}{path}",
        headers={"Authorization": f"Bearer {access_token}"},
    )
    res.raise_for_status()
    return res.json()

# Usage with automatic refresh
token = get_access_token(CLIENT_ID, SECRET)

expires_at = time.time() + token["expires_in"]

def api_call(path: str) -> dict:
    global token, expires_at
    if time.time() > expires_at - 60:  # 60 s margin to avoid rejections due to network latency
        token = refresh_access_token(token["refresh_token"])
        expires_at = time.time() + token["expires_in"]
    return call_axeptio_api(token["access_token"], path)

Reference

The complete list of available endpoints is documented in the Axeptio Swagger (currently being updated). For an overview of what the API can do, see Using the Axeptio API.

If your API requests return an authentication error

Check how your code obtains its token. If it sends a username and password, that's the problem: this method has been discontinued since July 10, 2026, and the tokens it produced have been invalidated.

Generate a personal token by following step 1, then replace the request that sends your username and password with the one in step 2. The rest of your integration remains unchanged: the Authorization: Bearer header is identical.

Need help?

If your requests fail, if your credentials are not visible in Axeptio administration, or if you have any other questions, feel free to contact our support team.

Authenticating your API requests to Axeptio