Authentication

The Partner API uses the OAuth2 client credentials grant. You exchange a client ID and secret for a short-lived bearer token.

Credentials

A credential is a client_id (it starts with dtpk_) and a client_secret. Each credential has a fixed set of scopes and one environment.

Keep the secret on your server. It is stored hashed on our side, so it can't be shown again or recovered. If it leaks or is lost, ask us for a new credential.

Getting a token

curl -X POST https://api.dawatrack.com/partner-api/v1/oauth/token/ \
  -H "Content-Type: application/json" \
  -d '{"client_id": "dtpk_...", "client_secret": "..."}'

The response carries the token, how long it lasts in seconds, the scopes it holds and its environment:

{
  "access_token": "AbC123...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "products:read batches:read recalls:read",
  "environment": "PRODUCTION"
}

Tokens last 60 minutes. There is no refresh token: request a new one when it expires. The token is opaque, not a JWT, so don't decode it.

The endpoint follows the OAuth 2.0 client credentials grant (RFC 6749), so an OAuth client library works with it: it may send grant_type=client_credentials, and the credentials in the body or with HTTP Basic. Responses are sent with Cache-Control: no-store. An error has an OAuth error code: invalid_client (401) for a wrong, unknown or revoked credential, invalid_request (400) when one is missing, unsupported_grant_type (400) for another grant.

See the token endpoint reference for every field.

Using the token

Send it in the Authorization header on every call:

Authorization: Bearer AbC123...

A missing, invalid or expired token gets 401. A valid token without the scope an endpoint needs gets 403.

Endpoints without a token

A few endpoints need no token: the token endpoint itself, the public recall lookup, and the version and health endpoints. They are limited per IP address instead.