Authentication

These steps are intended for TRADE customers (technical users) to authenticate against ComboBuilder services using API credentials.

Before proceeding, make sure you have your Client ID and Secret Key. If you don't have them yet, follow the API Token Generation Guide first.

1. Exchange API Credentials for Access & Refresh Tokens

   • Endpoint:

     POST https://authentication.lsports.eu/identity/resources/auth/v1/api-token
   • Headers:

     Content-Type: application/json
   • Body:

     { "clientId": "<Client ID>", "secret": "<Secret Key>" }
   • Response:

     { "expires": "<Thu, 22 May 2025 11:49:22 GMT>", "expiresIn": 1800, "accessToken": "<JWT access token>", "refreshToken": "<Refresh token>" }
   • Notes:

     • accessToken expiresIn = 30 minutes.
     • refreshToken lives for 7 days.
2. Refresh the Access Token

   • Endpoint:

     POST https://authentication.lsports.eu/identity/resources/auth/v2/api-token/token/refresh
   • Headers:

     Content-Type: application/json
   • Body:

     { "refreshToken": "<Previous refreshToken>" }
   • Response:

     { "expires": "<Thu, 22 May 2025 11:49:22 GMT>", "expiresIn": 1800, "accessToken": "<JWT access token>", "refreshToken": "<Refresh token>" }
3. Use the Access Token

   For every API call to ComboBuilder backend services, include the latest accessToken in the Authorization header:

   Authorization: Bearer <accessToken>

Remember, the accessToken expires every 30 minutes.