Access tokens

Learn how to manage access tokens.

Access tokens are essential credentials that allow an application to authenticate and access specific resources or APIs. They act as a key, providing a secure means to access server resources on behalf of the user. This section will guide you through obtaining and managing these tokens for seamless integration with our services.

Getting an access token

To get started with integrating our APIs into your application, the first step is to obtain an access token. An access token is a vital piece of authentication that your application will need to communicate with our APIs securely. This token confirms your application's permission to access particular resources and perform actions. In the following sections, we'll walk you through the necessary steps to acquire an access token using a simple cURL command. This process is designed to be straightforward, ensuring you can quickly get your application up and running with our services.

Use the GET /oauth20/access-token to get an access token.

cURL

curl --location -g --request GET 
'https://api.digitalriver.com/oauth20/access-token' \
--header 'Authorization: bearer {{access_token}}' \
...

200 OK response

{
  "sessionId": "your_session_ID",
  "userId": "your_user_ID",
  "externalReferenceId": "external_reference_ID",
  "authenticated": "true",
  "locale": "en_US",
  "currency": "USD",
  "cartId": "your_cart_ID",
  "clientIpAddress": "string",
  "domain": "drh-api-ot04.digitalriverws.net",
  "expiresIn": 86397,
  "themeId": "string",
  "sessionTag": "session_tag"
}

Ensure you replace {{access_token}} with your actual bearer token provided during the authentication process. This command will initiate a GET request to the specified URL, fetching the access token required for further API calls.

Deleting an access token

You may want to delete an access token when:

• For instance, after completing all required API calls, the token is no longer needed.

• You wish to secure your application by periodically refreshing tokens, thus reducing the risk of token theft.

• Your application's user logs out, ensuring their session is completely terminated and cannot be reused without re-authentication.

Use the DELETE /oauth20/access-token to delete an access token.

cURL

curl --location -g --request DELETE 'https://api.digitalriver.com/oauth20/access-token' \
--header 'Authorization: bearer {{access_token}}' \
...

200 OK response

{
  "sessionId": "your_session_ID",
  "userId": "your_user_ID",
  "externalReferenceId": "external_reference_ID",
  "authenticated": "true",
  "locale": "en_US",
  "currency": "USD",
  "cartId": "your_cart_ID",
  "clientIpAddress": "string",
  "domain": "drh-api-ot04.digitalriverws.net",
  "expiresIn": 86397,
  "themeId": "string",
  "sessionTag": "session_tag"
}

Ensure {{access_token}} is replaced with the actual bearer token you intend to delete. This command sends a DELETE request to the URL, revoking the specified access token.