Authentication call and obtaining a valid bearer token

To use the SigningHub Rest API, an authentication call must be executed to obtain an access token.

We'll need several parameters for this call:

API URL
Client ID
Client Secret
Username
Password
(Scope)

API URL

The API URL for our shared environments are:

Acceptance:
```
https://sh-acc-api.keysign.eu
```
Production:
```
https://sh-api.keysign.eu
```

After these URLs should be added /authenticate for our authentication call. So we'll go with https://sh-acc-api.keysign.eu/authenticate

Client ID and Client Secret

To see how a client ID and client secret can be obtained, please see Setting up a SigningHub API connector

Username and password

The username and password to execute an API call can by default be of any registered user.

Here, we will use the user sh-acc+keysigntest@keysign.site with the corresponding password.

Scope

An SigningHub Authentication API call can have an extra "scope" parameter in the body. When an enterprise administrator uses the scope, he can identify himself as the user defined in the scope. (for example, if enterprise administrator sh-acc+keysigntest@keysign.site uses the parameter "erwin.mintiens@test.com" as scope, he will act on behalf of erwin.mintiens@test.com for all API calls executed with the bearer token obtained with this call. erwin.mintiens@test.com must however be a registered user within the same enterprise.

Executing the call

We have all our parameters, so now we are ready to execute the authentication call POST call

As request headers, we will use:

Content-Type: application/x-www-form-urlencoded
Accept: application/json

As request body, we will use the x-www-form-urlencoded form with all previously obtained parameters.

When executing this call, the response should be a 200 OK, with an access_token in the body.

This access token can be used in the header of all following API calls as authentication as follows:

Authorization: Bearer <access_token>

This access token is valid for 24 hours by default.