Authentication

The API authenticates every request with a JSON Web Token (JWT). There are no API keys: you log in with the same username and password you use on the website, and get a token back.

Get a token#

Send your username (or email) and password. The answer carries the accessToken, its expiry exp (a Unix timestamp) and your user.

{
  "username": "janedoe",
  "password": "your-password"
}

Two-factor authentication#

If two-factor authentication is on for your user, the login also needs the current 6-digit code from your authenticator app, in twoFactorToken:

{
  "username": "janedoe",
  "password": "your-password",
  "twoFactorToken": "123456"
}

Without the code the login answers 401 with data.twoFactorRequired: true; a wrong code answers 401 Invalid two-factor code. Codes change every 30 seconds, so an integration that runs unattended has to log in while someone can type the code, or use a user without two-factor authentication that is limited to what the integration needs.

Send the token#

Put the token in the Authorization header of every other request:

curl https://sandbox.weshipyou.com/api/v1/accounts \
  -H "Authorization: Bearer $WSY_ACCESS_TOKEN"

• No token, or an expired or malformed one: 401 NotAuthenticated.
• A token for a user who is not a member of the account: 403 Forbidden or 404 NotFound.

When the token expires (at exp), log in again. There is no refresh token.

Test and live tokens#

The sandbox and live servers have separate users and separate tokens. A token from one is refused by the other. See Test mode and live mode.