Skip to content

Authorization

All requests to the API must include a valid access token.

If you already have your client_id and client_secret, you can obtain an access token from our authentication service by running the following command:

curl --request POST \
  --url https://login.gcmu.net/oauth/token \
  --header 'content-type: application/json' \
  --data '{
    "client_id": "<CLIENT_ID>",
    "client_secret": "<CLIENT_SECRET>",
    "audience": "registry-core-prod",
    "grant_type": "client_credentials"
  }'

Once you’ve obtained a token, include it in every API request using the standard Authorization header:

curl https://eqe.api.gcmu.net/api/v2/<path> \
  -H "Authorization: Bearer <your_token_here>"

Token lifetime

An access token is valid for 24 hours (86400 seconds) from when it is issued. The expires_in field of the token response gives the exact lifetime in seconds. There is no refresh token: when a token expires, request a new one with the same client_id and client_secret.

Rotating and revoking a credential

An Organisation Administrator manages credentials under Settings › API Credentials.

  • Rotate Secret issues a new client_secret, shown once. The old secret stops working immediately, and so does every token already issued with it, so the integration fails until it is given the new secret.
  • Revoke ends the credential for good. It can no longer obtain tokens, and tokens already issued with it stop working immediately.