As part of the authentication flow outlined in Authenticating with an Auth Token, this endpoint is called to request an access token which can be used to authorize subsequent requests. This access token will have an expiration time that is up to 8 hours in the future.

Refer to the Auth Token Management doc for more information on managing your /auth_token

Endpoint Authentication

When your client application was first created, the response contained two values of interest here:

• client_id
• client_secret

Authentication at this endpoint is accomplished using HTTP Basic Authentication , and uses your application's client_id and client_secret as the username and password component of the Authorization: Basic username:password string.

You can obtain your application's client_id and client_secret via the Sila Console.
Refer to the Register Your Application docs

Requesting an Auth Token

A POST request to this endpoint will request an Auth Token.

There is no benefit to repeatedly requesting an Auth Token

If you re-request a token for your client app while your current token has more than 30 minutes left before it expires, the API will return the same token from the previous request. Only when your token has less than 30 minutes left will a new token with a full 8-hour window be issued.

Auth Token re-use

📘

Caching the access token

Please refer to the sections relating to Token Caching and Usage of a cached access token in Authenticating with Auth Tokens - Caching an Auth Token.

Requests

The request header must implement HTTP Basic Authentication with an Authorization: Basic header, and the request "data header" must contain the app's auth_handle.

Building and encoding an HTTP Basic Authentication credentials string

Building
Construct the credentials string by concatenating the client_id, a single colon (:) character, and the client_secret.

Encoding
When the time comes to add the credentials string to the Basic auth header, you need to first encode with Base64 as a utf-8 value, then convert that value to an ASCII string.

Here's an example of how that is done in Python and Javascript:

const basicAuthString = 'Basic ' + Buffer.from(CLIENT_ID + ':' + CLIENT_SECRET).toString('base64');

>>> base64.b64encode(b'my_app_client_id:my_app_client_secret').decode('utf-8')
'bXlfYXBwX2NsaWVudF9pZDpteV9hcHBfY2xpZW50X3NlY3JldA=='

POST /0.2/access_token HTTP/1.1
Host: sandbox.silamoney.com
Authorization: Basic bXlfYXBwX2NsaWVudF9pZDpteV9hcHBfY2xpZW50X3NlY3JldA== 
Content-Type: application/json

{
  "header": {
    "created": 1234567890, 
    "auth_handle": "handle.silamoney.eth",
    "version": "0.2", 
    "reference": "<your unique id>"
    
  }
}

***

HTTP/1.1 200 OK

{
  "success": True,
  "access_token": {
    "token": "<a 205-character string>",
    "expiration": 1611514008,
    "expiration_dt": "2021-01-24T18:46:48.788837Z"
  }
}

Responses

The response will contain a JWT access token, the token's expiration time in both epoch and human-friendly format, and a success boolean.

Invalidating an Auth Token

If you feel that your application's current and unexpired Auth Token has become compromised, you may immediately invalidate it by calling this endpoint with a DELETE method.

DELETE /0.2/access_token HTTP/1.1
Host: sandbox.silamoney.com
Authorization: Basic bXlfYXBwX2NsaWVudF9pZDpteV9hcHBfY2xpZW50X3NlY3JldA== 
Content-Type: application/json

{
  "header": {
    "created": 1234567890, 
    "auth_handle": "handle.silamoney.eth",
    "version": "0.2", 
    "reference": "<your unique id>"
    
  }
}

***

HTTP/1.1 200 OK

{
  "success": True
}

Requests

Responses

For Authentication failure responses refer to the Authenticating with an Auth Token docs.