Authentication
This guide will walk you through the steps to authenticate your requests and access Alpha Connect securely.
Obtain client ID and secret
Before you can authenticate requests, you need to request API credentials. Contact your Alpha Client Services Manager to request a client ID and secret.
There will be separate credentials for the production environment and for the sandbox. See the authorisation API documentation section for technical implementation.
Get Bearer Token
Once you have your client ID and secret, you can request an OAuth 2.0 bearer token from our authentication server. The bearer token has an expiry time of 1 hour, so you will have to re-request if your session is longer than an hour.
Example
POST <https://sandbox.api.alphagroup.com/api/v1/oauth2/token>
Body Content Type:
w-www-form-urlencoded
| Key | Value | Details |
|---|---|---|
grant_type | client_credentials | Fixed value of "client_credentials" |
client_id | {API Key} | Unique Client Id |
client_secret | {Client Secret} | Unique Client Secret |
scope | {scope} | Specify the services available for requests |
authorization | {Key & Secret} | Optional way of passing encoded credentials |
Response
| Name | Type | Description |
|---|---|---|
access_token | string | This is the token that needs to be included in the header of all requests |
expires_in | Integer | 3600 - number of seconds until expiry |
token_type | string | Bearer |
Authorise Requests
In your HTTP requests be sure to add a header with the key authorization and the value “Bearer “ and {token}. Replace {token} with the actual bearer token you get from the authorisation server.
Encoded authorisation
For additional security you can choose to Base64 encode an authorisation request.
Combine the client ID and secret into a single string, then encode it using Base64 before including it in the Authorisation header of the HTTP request. You can test this on the authorisation API reference page.
Scope
Tokens can have limited scope meaning they will only be able to access certain services provided within the API. This can be useful if you want given systems to be limited to certain functionality. Populating the scope field will specify scope, leaving it empty will grant scopes.
The references to these can be seen below.
| Service | Environment | Scope |
|---|---|---|
| Reporting API | Sandbox | preprod-api/reporting |
| FX API | Sandbox | preprod-api/fx |
| Reporting API | Production | prod-api/reporting |
| FX API | Production | prod-api/fx |
Authenticate via Postman
See our guide on how to authenticate from postman.
HTTPS Encryption
Ensure that all API requests are made over HTTPS to encrypt the data transmitted between your application and our server. HTTPS encryption adds an extra layer of security by protecting the integrity and confidentiality of your data during transmission.
Handle Authentication Errors
In case of authentication errors, our API will return an appropriate error response with the relevant HTTP status code (e.g. 401 Unauthorized). Please handle these errors gracefully in your application and prompt the user to re-authenticate by getting a new token with the new time to leave.
Securely store client ID and secret
Store your API key securely and avoid hardcoding it directly into your application code. Consider using environment variables or secure storage mechanisms provided by your development platform to store sensitive information such as API keys and passwords.
Rotate API client ID and secret
It is best practice to periodically rotate your API client ID and secret. By regularly requesting new API keys and retiring old ones, you can minimise the risk of unauthorised access and enhance the security of your account and data.
End session
By sending a request to the session termination endpoint, the active session will end, revoking access to the API resources. This termination process can help prevent unauthorised access and potential security breaches, particularly in cases where access credentials have been compromised or when users or applications no longer require access to the API.
Leveraging this endpoint to terminate API sessions enhances data security and helps maintain efficient API management practices.
Stay Safe
By following these authentication best practices, you can securely authenticate your requests and access Alpha Connect with confidence.
If you have any questions or encounter any issues regarding authentication, don't hesitate to reach out to our support team for assistance.
Updated about 2 months ago