# Private token API

### Get your Private Token API key

Please contact your account manager to get your Private Token API.

{% hint style="danger" %}
You are responsible for keeping the key **secure and private.**. \
**Never use the** **Private** **Token** **key** **in** **Front-end code or pushed in a public repository.**&#x20;
{% endhint %}

## Type of secret Token

You can choose between a Long-lived token to use only from your backend to ask resources to Rezi API. The short live token can be used in the front end directly, but please respect this flow to keep all your service secure.

### Long-lived Secret Token

Get resources from the backend only with the secret token. The extended expiration time of the secret token is more vulnerable, it should only be used in a protected environment.

<figure><img src="https://3620844767-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqyU6JFWCc7PaeylJxLzy%2Fuploads%2FdoaWcJ6rD0mRUotiDG3a%2FScreen%20Shot%202022-08-29%20at%209.58.19%20AM.png?alt=media&#x26;token=cff6e6d1-5fc3-4440-8eac-373e9a6813dd" alt=""><figcaption></figcaption></figure>

#### How to get your Long-lived Secret Token

Get your Long-lived token from your Rms Admin Dashboard. You can revoke it from your dashboard.

### Short-lived Token

Use a short-lived token to increase security. Valid for 15 minutes, /accessToken API returns the access\_token and the expiration time. You can build on your side a refresh system to keep a fresh token or wait until you receive a 401 error code "Jwt verification fails" to refresh it.&#x20;

<figure><img src="https://3620844767-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqyU6JFWCc7PaeylJxLzy%2Fuploads%2F5tqRGCIhOxdTUyakSAC2%2FScreen%20Shot%202022-08-29%20at%209.51.04%20AM.png?alt=media&#x26;token=29c1cbf6-8e01-4d83-ae5d-a3ce72e404de" alt=""><figcaption></figcaption></figure>

### Get an access token by following the step.

#### 1/ Visit your RMS admin page by login with an admin account&#x20;

{% hint style="info" %}
Use the query admin-access to access the login page and bypass automatic user redirection.&#x20;

-> app.your-rms.com/login?**admin-access=true**
{% endhint %}

#### 2/ Visit the Open API tab in the RMS admin section

<figure><img src="https://3620844767-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqyU6JFWCc7PaeylJxLzy%2Fuploads%2FHUQGGamZ5VOYDoqgdhQU%2FScreen%20Shot%202022-09-01%20at%204.39.28%20PM.png?alt=media&#x26;token=76953739-0735-4ff8-9b0b-55c9ddac6038" alt=""><figcaption></figcaption></figure>

#### 3/ Create a Long-lived private token API access by clicking Create Secret key

You can use Create Test Secret key to separate your test from production

**4/ Call accessToken API**&#x20;

Call with the Long-lived token from your backend to receive a short-lived token API (15-minute expiration time) that can be used directly from your client's front end.

## Client requests an access token

<mark style="color:blue;">`GET`</mark> `https://open-api.rezi.ai/v1/accessToken`

Request a short-lived access token to share with front-end

#### Headers

| Name                                             | Type   | Description                                                                                                                                                |
| ------------------------------------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication<mark style="color:red;">\*</mark> | String | <p>"Bearer PRIVATE\_TOKEN\_API\_KEY" <br>Authentication token to secure and track down your usage. Use this specific format with your Private API key.</p> |

{% tabs %}
{% tab title="200: OK return short-lived access token" %}

```javascript
{
    "code": 200,
    "message": "success",
    "token":
"eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJSUzI1NiIsICJraWQiOiAiYjYzZmRkMDA0YzQ3MmE0NmM3ODFlNzZmZmZmYTI2ODA4YjcyM2RhNCJ9.eyJpYXQiOiAxNjYxNzUyMzYxLCAiZXhwIjogMTAwMDAwMDAwMDAsICJpc3MiOiAib3Blbi1hcGktand0LWtleUByZXppLTNmMjY4LmlhbS5nc2VydmljZWFjY291bnQuY29tIiwgImF1ZCI6ICJ2MS0zOHRpN3V0eW1nZXg2LmFwaWdhdGV3YXkucmV6aS0zZjI2OC5jbG91ZC5nb29nIiwgInN1YiI6ICJvcGVuLWFwaS1qd3Qta2V5QHJlemktM2YyNjguaWFtLmdzZXJ2aWNlYWNjb3VudC5jb20iLCAiZW1haWwiOiAib3Blbi1hcGktand0LWtleUByZXppLTNmMjY4LmlhbS5nc2VydmljZWFjY291bnQuY29tIiwgInJtcyI6ICJyZXN1bWFpIn0.0In0SaEwvUu1sCSlVsREuSSY7UVd0MkstvqMsjTwQowbZjJgGoZVQjM4eJScKhOCZfnFwnYu6vFOkHo1PjeGKKdZ00W9R-AnyYLryEyijIrLgUUT1wuhaz1QJ-F6lG_D2nraWyb8QHIZKSIJZy8so0IWSYi04tyJvZj0lIJ0zSBAoP8W841HlqvN-u8P7HRWdcH5PSrUOhB27IL6XRez_tbxEU3aIv64HGasfgx9gBTfgK1tAmrIQu6EtG4X6BQOnmsBeidGwJSBttXNjf6uLKpFv1E5J4Gw3utclVklxuPC0vSKCwVQHro6rbzZ77wd8_ti77ODFP7H1qjlpUuutQ",
    "expired": 1661755961
}
```

{% endtab %}

{% tab title="500: Internal Server Error " %}

```javascript
{
    // Response
}
```

{% endtab %}

{% tab title="401: Unauthorized Long-lived token not authorized or expired" %}

```javascript
{
    "code": 401,
    "message": "Jwt verification fails (02)"
}
```

{% endtab %}
{% endtabs %}
