Authentication

OCTO uses Bearer authentication. To authenticate requests, an API key must be sent as a Bearer token in the Authorization header of your request:

GET /supplier HTTP/1.1
Host: {host}
Authorization: Bearer {your_API_key}

For security reasons, it's recommended to use a single unique API key per reseller-supplier relationship.

All API requests must be made over HTTPS. Calls made over plain HTTP should fail. API requests without authentication will also fail. If the token is invalid or is deactivated by Supplier a 403 Forbidden error should be returned.