Get Auth Token
Exchanges your partner clientId + clientSecret for a short-lived Bearer token used on all subsequent calls.
/public/getAuthTokenHeaders
| Header | Required | Description |
|---|---|---|
clientId |
Yes | Your LookzUp-issued client ID |
clientSecret |
Yes | Your LookzUp-issued client secret |
Example Request
curl --location --request POST '{base_url}/public/getAuthToken' \
--header 'clientId: {your_client_id}' \
--header 'clientSecret: {your_client_secret}'
Example Response
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...(truncated)",
"expires_in": 3600,
"token_type": "Bearer"
}
Security Notes
- Call this endpoint only from your backend. Never embed clientId/clientSecret in front-end code.
- Store credentials in environment variables (e.g. .env), not in source control.
- Cache and re-use the returned access_token for the full session (expires_in seconds ≈ 1 hour) instead of requesting a new token per call.
- Use the token as
Authorization: Bearer {access_token}on subsequent calls unless otherwise noted.
The decoded token carries tenantId, clientId and a scope array (e.g. member.read, booking.write, customer.read, membership.write).
