SnackMagic Authentication API
Stadium uses JWT (as Bearer token) for authentication. API provides 4 different methods to generate the token: 1. Client Credentials 2. Authorization Code (OAuth2) 3. Authorization Code using PKCE 4. Token using refresh token The authentication method to be used depends on your use case - whether you want to place orders using a global organizer account or user's own Stadium Account and your implementation details. For each method, once you generate a _token_, it needs to be set as the _Bearer_ token in the **Authorization** header. The _token_ is valid for **24 hours**. The _token_ validity can be checked with our **Validate token** API endpoint. Once expired, a new _token_ will need to be generated using the same API endpoint as used earlier. ### Client Credentials This should be used if you are an organizer and want to place an order or send points using a **global** organizer account. You can directly use the **Get Token** API endpoint to fetch the _token_ that can then be used in other APIs for authorization. ### Authorization Code (OAuth2) This should be used if you want to place an order or send points on **behalf** of a Stadium user. This uses Oauth2 flow where you will need need to make an **Authorize** request first. This will redirect the user to the Stadium login page and once they sign in, a *code* is received on the given `redirect_url`. Using this _code_, the _token_ can be fetched using the **Get Token by Code** API providing both `client_id` and `client_secret`. The `redirect_url` should be the same as given in the authorize call. ### Authorization Code using PKCE If you want to use the Authorization code method but cannot store the `client_secret` securely (like native application or SPA) you should use this flow. In this you need to [generate a PKCE](https://developer.pingidentity.com/en/tools/pkce-code-generator.html) `code_challenge` and `code_verifier` using the SHA256 method. The `code_challenge` needs to sent as an additional param to the **Authorize** request. Once the _code_ is received send the `code_verifier` as the param (instead of `client_secret`) to the **Get Token by Code** API. ### Token using refresh token You can use this to issue a new access token using an existing access token and a refresh token.