Authentication

The Caliza API uses the OAuth 2.0 standard for authentication. Make all requests to protected endpoints via HTTPS and include a valid Bearer Token in the header.

Overview

To interact with the API, you must exchange your integrator credentials (Client ID, Client Secret, Username, and Password) for a temporary access token.

• Standard: OAuth 2.0
• Token Type: Bearer JWT
• Required Credentials: client_id, client_secret, username, password

Step 1: Get credentials

Before starting, you need credentials to access the environment (Sandbox or Production).

1. Dashboard Access: Once you finish onboarding and compliance, you'll get an email with a link to create your password.
2. Client ID and Secret: In the integrator Dashboard, navigate to the profile/settings section to view your Client ID and Client Secret.

Step 2: Generate an Access Token

To get the token, make a POST request to the authentication endpoint, sending your credentials in the request body.

curl --location 'https://api.sandbox.caliza.com/auth/realms/caliza/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'client_id=YOUR_CLIENT_ID' \
--data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \
--data-urlencode 'username=YOUR_EMAIL' \
--data-urlencode 'password=YOUR_PASSWORD'

{
    "access_token": "eyJhbGciOiJIUzI1Ni...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "scope": "read write"
}

Body Parameters: x-www-form-urlencoded or JSON, where:

Step 3: Use the Token in the API

With the token in hand, you must include it in the Authorization header of all subsequent API calls. The format must be Bearer <access_token>.

Authenticated Call Example

Below is an example of how to query integrator data using the generated token.

Endpoint: GET /v1/integrators/me

curl --location 'https://api.sandbox.caliza.com/core-api/v1/integrators/me' \
--header 'Authorization: Bearer Your_Token' \
--header 'Content-Type: application/json'

Auth Error Handling

Here you can find the standard HTTP status codes related to authentication errors: