# SnackMagic Authentication API

**Canonical:** https://apis.io/apis/snackmagic/snackmagic-authentication-api/  
**Provider:** SnackMagic — https://apis.io/providers/snackmagic/  
**Base URL:** https://api.bystadium.com/api/v2  
**Documentation:** https://api.bystadium.com/api/v2/docs

SnackMagic Authentication API is one of 5 APIs that [SnackMagic](https://apis.io/providers/snackmagic/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Authentication. The published artifact set on APIs.io includes an OpenAPI specification.

Stadium uses JWT (as Bearer token) for authentication. API provides 4 different methods to generate the token: 1. Client Credentials 2. Authorization Code (OAuth2) 3. Authorization Code using PKCE 4. Token using refresh token The authentication method to be used depends on your use case - whether you want to place orders using a global organizer account or user's own Stadium Account and your implementation details. For each method, once you generate a _token_, it needs to be set as the _Bearer_ token in the **Authorization** header. The _token_ is valid for **24 hours**. The _token_ validity can be checked with our **Validate token** API endpoint. Once expired, a new _token_ will need to be generated using the same API endpoint as used earlier. ### Client Credentials This should be used if you are an organizer and want to place an order or send points using a **global** organizer account. You can directly use the **Get Token** API endpoint to fetch the _token_ that can then be used in other APIs for authorization. ### Authorization Code (OAuth2) This should be used if you want to place an order or send points on **behalf** of a Stadium user. This uses Oauth2 flow where you will need need to make an **Authorize** request first. This will redirect the user to the Stadium login page and once they sign in, a *code* is received on the given `redirect_url`. Using this _code_, the _token_ can be fetched using the **Get Token by Code** API providing both `client_id` and `client_secret`. The `redirect_url` should be the same as given in the authorize call. ### Authorization Code using PKCE If you want to use the Authorization code method but cannot store the `client_secret` securely (like native application or SPA) you should use this flow. In this you need to [generate a PKCE](https://developer.pingidentity.com/en/tools/pkce-code-generator.html) `code_challenge` and `code_verifier` using the SHA256 method. The `code_challenge` needs to sent as an additional param to the **Authorize** request. Once the _code_ is received send the `code_verifier` as the param (instead of `client_secret`) to the **Get Token by Code** API. ### Token using refresh token You can use this to issue a new access token using an existing access token and a refresh token.

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/openapi/snackmagic-authentication-api-openapi.yml
- **ErrorCatalog** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/errors/snackmagic-problem-types.yml
- **Conventions** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/conventions/snackmagic-conventions.yml
- **DataModel** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/data-model/snackmagic-data-model.yml
- **Conformance** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/conformance/snackmagic-conformance.yml
- **Lifecycle** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/lifecycle/snackmagic-lifecycle.yml
- **Sandbox** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/sandbox/snackmagic-sandbox.yml
- **APIsJSON** — https://raw.githubusercontent.com/api-evangelist/snackmagic/refs/heads/main/apis.yml

## Other SnackMagic APIs (4)

- [SnackMagic Automation management API](https://apis.io/apis/snackmagic/snackmagic-automation-management-api/)
- [SnackMagic Order management API](https://apis.io/apis/snackmagic/snackmagic-order-management-api/)
- [SnackMagic Store management API](https://apis.io/apis/snackmagic/snackmagic-store-management-api/)
- [SnackMagic User management API](https://apis.io/apis/snackmagic/snackmagic-user-management-api/)

## Tags

Authentication

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/snackmagic/snackmagic-authentication-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/snackmagic/.