Authentication

Authentication mechanism

The ZapCloud API employs the OAuth 2.0 Resource Owner Password Credentials (ROPC) Grant type. This method involves exchanging user credentials directly for an access token, which is then used to authorize subsequent API requests. You can access here -> Open API spec

Authentication workflow

The authentication process involves obtaining an access token, using it for API requests.

Step 1: Requesting an access token

To begin interacting with the API, your application must first obtain an OAuth Bearer Token.

Do not hardcode Zaptec usernames, passwords, or access tokens in your application. Store credentials in secure configuration, environment variables, or a secrets manager.

HTTP Method: POST
Endpoint: https://api.zaptec.com/oauth/token

Request Details:

Headers:
- Content-Type: application/x-www-form-urlencoded
Body Parameters (form-urlencoded):
- grant_type: Must be set to password.
- username: Your registered Zaptec account username.
- password: Your Zaptec account password.

Example: Token request

curl --location 'https://api.zaptec.com/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode '[email protected]' \
--data-urlencode 'password=your_password' \
--data-urlencode 'scope=openid'

Samplecurl request with bearer token for API acces

Successful Response:

A successful request returns a JSON object containing the access_token and other relevant information.

{
  "access_token": "your_received_access_token",
  "token_type": "Bearer",
  "expires_in": 3600, // Lifespan of the access token in seconds
  "scope": "openid" // Example scopes granted
}

Step 2: Using the access token

Once an access_token is obtained, include it in the Authorization header for all API calls to protected resources.

Header Format: Authorization: Bearer {access_token}
(Replace{access_token} with the token value received.)

Example: API Call with Access Token

GET /api/some_protected_resource
Host: api.zaptec.com
Authorization: Bearer your_received_access_token

Treat access_token values as sensitive credentials. Store tokens securely, avoid exposing them in browser code or URLs, and request a new token before the current token expires.