Authentication

Authentication

Every request carries a bearer token. The token identifies both you and your channel, so you never send a seller or channel id with a product.

POST /api/bobsync/products HTTP/1.1
Host: api.tools.bobshop.co.za
Authorization: Bearer YOUR_UNIQUE_TOKEN
Content-Type: application/json

Your token

  • It is generated when an administrator installs an API source on Bob Sync for your account. You cannot create one yourself. Contact support.
  • It is shown once, when the channel is created, and cannot be viewed again or rotated. Store it as soon as you receive it. If it is lost, the channel has to be recreated, with a new token and a re-send of your catalogue.
  • It does not expire. It stays valid until the channel is removed.
  • It is tied to one environment. Sandbox is our QA environment, and a Sandbox token does not work on Production, or the other way round. You are issued one for each. Keep them apart so a test run cannot write to your live listings.

Keeping it safe

  • Treat it as a password. Never put it in client-side code, a public repository or a support ticket.
  • Call the API over HTTPS only.
  • Store it as a secret: an environment variable or a secret manager, not source control.
  • If it is exposed, contact support at once. A leaked token means the channel has to be recreated.

Failures

Status Body Meaning
401 Cookie, platform or header auth is required No Authorization header.
401 Invalid authentication token: ... The header has no Bearer prefix.
401 api key is not valid The token is not recognised, or its channel has been removed.
401 invalid endpoint The token was sent to a path outside /api/bobsync/.
View as Markdown