Authentication

Overview

Limpidius APIs use short-lived Bearer tokens to authorize requests, following the OAuth 2.0 authorization framework. Tokens are obtained from the Limpidius authorization server and must be included in every API request.

The authorization server endpoint is:

https://accounts.limpidius.com/auth/realms/limpidius/protocol/openid-connect/token

Service accounts

For server-to-server integrations, authentication is done using a service account with the OAuth 2.0 Client Credentials grant. A service account is bound to a single tenant and environment: it cannot switch between them at runtime.

Your client_id and client_secret are provided by Limpidius upon account setup. Contact our team if you have not received them.

Requesting a token

Send a POST request to the authorization server with your credentials:

curl --request POST \
  'https://accounts.limpidius.com/auth/realms/limpidius/protocol/openid-connect/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id={YOUR_CLIENT_ID}' \
  --data-urlencode 'client_secret={YOUR_CLIENT_SECRET}'

Token response

A successful response returns a JSON object containing the access token:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5...",
  "expires_in":   7200,
  "token_type":   "bearer"
}

Use the value of access_token as the Bearer token in subsequent API requests:

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5...

Token expiry

Access tokens are short-lived. The expires_in field indicates the validity duration in seconds. Once expired, request a new token by repeating the same call: there is no refresh mechanism for service accounts.

Using the token

Include the token in the Authorization header of every API request:

curl --request POST \
  '{BASE_URL}/platon/transactions' \
  --header 'Authorization: Bearer {YOUR_ACCESS_TOKEN}' \
  --header 'Content-Type: application/json' \
  --data '...'