Authenticating with the API

Exchange machine credentials for a bearer token, then call the API with it.

Machine tokens

The API authenticates machines, not people. You exchange credentials for a short-lived bearer token and send it on every subsequent request.

curl -X POST https://api.elcontract.com/api/v1/auth/machine-token \
  -H 'Content-Type: application/json' \
  -d '{"clientId":"...","clientSecret":"..."}'

const res = await fetch('https://api.elcontract.com/api/v1/auth/machine-token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ clientId, clientSecret }),
})
const { accessToken } = await res.json()

Using the token

Send the token as a bearer credential. Treat it as you would any secret: never in a URL, never in client-side code, never in a log.

cURL

curl https://api.elcontract.com/api/v1/templates \
  -H "Authorization: Bearer $ACCESS_TOKEN"