Authentication

Every request to a protected endpoint carries a credential in the Authorization header. There are two ways to get one and they are interchangeable: an api key, which does not expire, or an access token from the login, which lives 15 minutes.

Use an api key instead

Logging in with username and password is deprecated for API use. Create an api key in the customer portal and send it as Authorization: Bearer <key>: a key does not expire, so there is no login before a call.

The login endpoint keeps working. Your keys are managed in the portal.

Api key

Create a key in the customer portal at /portal/, on the page "Api keys". You see the key exactly once, right after creating it: we store only its checksum and cannot show it to you again. You may hold a small number of valid keys at a time, and the page says how many. A key you no longer need is revoked on the same page, which takes effect immediately.

Send it where the token would go:

curl https://api.axro.com/api/v1/product/ \
-H 'Authorization: Bearer axro_your_key_here'

A key does not expire, so there is nothing to refresh and no 401 to handle. It carries the same permissions as the user it belongs to, with one exception: a key may not manage keys. Create and revoke keys in the portal, where you sign in with your e-mail address and password. That way a key that fell into the wrong hands can neither create a second one nor revoke yours.

A key in a browser is a published key

The API answers calls from any origin, so you can call it from JavaScript in a browser. Be aware of what that means: anything your page sends is readable by the person using it. A key that reaches a browser counts as published, and it carries the permissions of the user it belongs to. Keep keys on your server and let your own backend talk to us, unless the data behind the key is meant to be public anyway.

Login with username and password

Deprecated for API use

This is no longer the recommended way to reach the API. It keeps working and is not switched off. Use an api key for your requests, and the portal to manage your keys.

POST/api/v1/login/

Login with username (e-mail) and password to get an access token

Name	Type	Required	Description
username	string	✅	Your AXRO account e-mail
password	string	✅	Your AXRO account password

Example Request

cURL

curl -X POST https://api.axro.com/api/v1/login/ \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'username=your_username&password=your_password'

JavaScript

// Using Fetch API
fetch('https://api.axro.com/api/v1/login/', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: 'username=your_username&password=your_password'
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));

PHP

// Using cURL
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 'https://api.axro.com/api/v1/login/');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'username=your_username&password=your_password');
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$error = curl_error($ch);

curl_close($ch);

if ($error) {
    echo "Error: " . $error;
} else {
    $data = json_decode($response, true);
    print_r($data);
}

Python

# Using requests library (recommended)
import requests

url = 'https://api.axro.com/api/v1/login/'
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
data = 'username=your_username&password=your_password'

response = requests.post(url, headers=headers, data=data)

print(response.status_code)
print(response.json())

Go

package main

import (
"fmt"
"io/ioutil"
"net/http"
"strings"
)

func main() {
url := "https://api.axro.com/api/v1/login/"
payload := strings.NewReader("username=your_username&password=your_password")

    req, err := http.NewRequest("POST", url, payload)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }
    
    req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
    
    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error sending request:", err)
        return
    }
    defer resp.Body.Close()
    
    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response:", err)
        return
    }
    
    fmt.Println("Response Status:", resp.Status)
    fmt.Println("Response Body:", string(body))
}

C#

// Using HttpClient (modern approach)
using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

class Program
{
  static async Task Main()
  {
    // Create HttpClient instance
    using (HttpClient client = new HttpClient())
    {
      // Set content type header
      client.DefaultRequestHeaders.Add("Content-Type", "application/x-www-form-urlencoded");

      // Create form content
      var formContent = new StringContent(
        "username=your_username&password=your_password",
        Encoding.UTF8,
        "application/x-www-form-urlencoded");
            
      // Make the POST request
      HttpResponseMessage response = await client.PostAsync(
        "https://api.axro.com/api/v1/login/", 
        formContent);
            
      // Read the response
      string responseBody = await response.Content.ReadAsStringAsync();
            
      // Check if request was successful
      if (response.IsSuccessStatusCode)
      {
        Console.WriteLine("Response: " + responseBody);
      }
      else
      {
        Console.WriteLine("Error: " + response.StatusCode);
        Console.WriteLine("Response: " + responseBody);
      }
    }
  } 
}

Example Response

{
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Token lifetime

An access token is valid for 15 minutes (900 seconds). The exact moment it expires is in the exp claim of the token itself, so your client can read it without asking us.

Reuse the token until it expires. Logging in before every request is the most expensive way to use this API: every login verifies your password with bcrypt, which is deliberately slow, so you pay that cost on every single call. One login every 15 minutes is enough, whatever your request volume is.

When a token has expired, the API answers 401 - Unauthorized. That is the signal to log in once more and repeat the request. Two lines in your client, and the login disappears from your hot path.