Authentication
Learn how to authenticate your Tuned Global API requests.
Tuned Global uses OAuth 2.0 for user authentication. All Services API access is managed through short-lived JWTs (access tokens) and longer-lived refresh tokens. Token lifetimes are returned in each authentication response.
There are four ways to obtain an access token:
- Email Login
- Refresh Token
- Mobile Login
- Third Party JWT
1
Email Login
Authenticate users with their email address and password. On success, a bearer token is issued that can be used to call all Services APIs for that user.
Request
curl -X POST \
'https://api-authentication-connect.tunedglobal.com/oauth2/token' \
-H 'StoreId: TEST' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'username=xxxx&password=xxxxx&grant_type=password'
Response
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
2
Refresh Token
Use a refresh token to obtain a new access token when the current one has expired. The refresh token itself has a 48-hour validity.
Request
curl --location 'https://api-authentication-connect.tunedglobal.com/oauth2/token' \
--header 'StoreId: TEST' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=xxxxx'
3
Mobile Login
Response
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
Authenticate users via their mobile or cell number. The user must first obtain a one-time passcode (OTP) and validate it on the front-end application before calling this endpoint.
Request
curl -X POST \
'https://api-authentication-connect.tunedglobal.com/oauth2/token' \
-H 'StoreId: TEST' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'msisdn=6112345678&grant_type=msisdn&code=123456789'
Response
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
4
Third party JWT validation
Supports JWTs generated by third parties using the asymmetric RS256 algorithm (private/public key pair). The client generates the key pair, signs the token with the private key, and Tuned Global validates it using the public key to extract claims.
Request
curl --location --request POST 'https://api-services-connect.tunedglobal.com/api/v3/users/authenticateThirdPartyJWT' \
--header 'StoreId: TEST' \
--header ‘Authorization: Bearer <Client_JWT>
Response
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
On this page
- Authentication