---
updatedAt: 2025-11-18T06:37:26.000Z
---

# Authentication

***

title: 'Authentication'
description: 'Learn how to authenticate with the Gett B2C API'
--------------------------------------------------------------

`import { Callout } from 'nextra/components'`

# Authentication

The Gett B2C API uses OAuth 2.0 client credentials flow for authentication. You'll need to obtain a bearer token before making any API requests.

<Callout type="info">
  Bearer tokens have a limited lifespan. Implement token refresh logic in your application to handle expired tokens gracefully.
</Callout>

## Obtaining a Bearer Token

### Endpoint

```
POST https://api.gett.com/v1/oauth/token
```

### Headers

```
Content-Type: application/x-www-form-urlencoded
```

### Parameters

| Parameter       | Type   | Required | Description                        |
| --------------- | ------ | -------- | ---------------------------------- |
| `client_id`     | string | Yes      | The client ID provided by Gett     |
| `client_secret` | string | Yes      | The client secret provided by Gett |
| `grant_type`    | string | Yes      | Must be `client_credentials`       |
| `scope`         | string | Yes      | Must be `demand_partner`           |

### Example Request

```bash
curl --request POST 'https://api.gett.com/v1/oauth/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'client_id=your_client_id_here' \
  --data-urlencode 'client_secret=your_client_secret_here' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'scope=demand_partner'
```

### Example Response

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "demand_partner"
}
```

## Using the Bearer Token

Include the bearer token in the `Authorization` header of all subsequent API requests:

```
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

### Example Authenticated Request

```bash
curl --request GET 'https://api.gett.com/v1/private/orders/status/12345' \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' \
  --header 'Content-Type: application/json'
```

## Token Expiration

Tokens expire after the time specified in the `expires_in` field (typically 3600 seconds or 1 hour). When a token expires, you'll receive a `401 Unauthorized` response.

### Handling Expired Tokens

1. Monitor the `expires_in` value from the token response
2. Implement automatic token refresh before expiration
3. Handle `401` responses by refreshing the token and retrying the request

### Example Token Refresh Logic

```javascript
class GettAPIClient {
  constructor(clientId, clientSecret) {
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    this.token = null;
    this.tokenExpiry = null;
  }

  async getToken() {
    if (this.token && this.tokenExpiry > Date.now()) {
      return this.token;
    }

    const response = await fetch('https://api.gett.com/v1/oauth/token', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
      },
      body: new URLSearchParams({
        client_id: this.clientId,
        client_secret: this.clientSecret,
        grant_type: 'client_credentials',
        scope: 'demand_partner'
      })
    });

    const data = await response.json();
    this.token = data.access_token;
    this.tokenExpiry = Date.now() + (data.expires_in * 1000) - 60000; // Refresh 1 minute early

    return this.token;
  }
}
```

## Security Best Practices

<Callout type="warning">
  **Never expose your client credentials in client-side code or public repositories.**
</Callout>

* Store client credentials securely (environment variables, secure key management)
* Use HTTPS for all API communications
* Implement proper error handling for authentication failures
* Consider implementing token caching to reduce authentication requests
* Rotate credentials periodically as part of your security practices

## Troubleshooting

### Common Authentication Errors

| Error              | Description                | Solution                                    |
| ------------------ | -------------------------- | ------------------------------------------- |
| `invalid_client`   | Invalid client credentials | Verify your `client_id` and `client_secret` |
| `invalid_scope`    | Invalid scope parameter    | Ensure scope is set to `demand_partner`     |
| `invalid_grant`    | Invalid grant type         | Ensure grant\_type is `client_credentials`  |
| `401 Unauthorized` | Token expired or invalid   | Refresh your token and retry the request    |