Authentication

The API uses JWT Bearer tokens. The flow has three steps:

1. Send your credentials to POST /api/auth/client/login.
2. The response includes token.access_token.
3. Attach the token to every request: Authorization: Bearer {access_token}.

:::info Public endpoints Endpoints under /api/open/ are public and don't require a token. :::

Token lifetime

• 15 minutesFrom the moment it is issued (expires_in: 900, in seconds).
• No refreshThere is no endpoint to refresh it: when it expires, repeat the login.
• At 14 minutesSuggested moment to request a new one, before it expires.

When it expires, request a new one by repeating the login with your client_id and client_secret. Renewing it a little before it expires avoids errors in the middle of an operation.

Authentication errors

Code	response_message	When it happens
401	Credenciales inválidas	The client_id doesn't exist or the client_secret doesn't match.
403	API client desactivado	The credentials are correct, but the API client is deactivated.
401	Autenticación requerida	The request doesn't include the Authorization: Bearer ... header.
401	Token inválido o expirado	The token expired or is not valid. Request a new one.

The API returns these messages in Spanish.