# API Authenticating

Authentication with the Rotageek API is via oAuth bearer tokens, so for all requests (excepting the Auth request itself), an http Authorization header must be supplied with the access token:

```
Authorization: Bearer <access_token>
```

---

To get a token, you must call the endpoint:

**POST /api/v1/auth**

With either:

The username/password of your API user:

```
curl -X POST --header 'Content-Type: application/x-www-form-urlencoded' --header 'Accept: application/json' -d 'grant_type=password&username=<username>&password=<password>' 'https://<rotageekapiurl>/api/v1/auth'
```

OR

The refresh token from a previous Auth request:

```
curl -X POST --header 'Content-Type: application/x-www-form-urlencoded' --header 'Accept: application/json' -d 'grant_type=refresh_token&refresh_token=%3Crefresh_token%3E' 'https://<rotageekapiurl>/api/v1/auth'
```

---

**Response**

The response will be in the following format:

1. {

2. // The access token you need to use in http Authorization header for subsequent calls

3. "access_token": "<redacted>",

4. "token_type": "bearer",

5. "expires_in": 1799,

6. // The refresh token you can use to get new Access Tokens when using the

7. // refresh_token grant_type in subsequent Auth requests

8. "refresh_token": "<redacted>"

9. }

---