IXON API Authentication
Learn what you need to to use to authenticate and use the IXON API.
Authentication at a glance
Every request to the IXON API has to identify which application is calling and who it is calling as, which is what the Application ID and the access token do respectively.
| API Header | Value | Example |
|---|---|---|
Api-Application | Your Application ID | 7NWcb4adPRTK |
Authorization | Bearer followed by your access token | Bearer Z6XevvDES13tQ2Ti3nDVBJyWS0kRw5D1 |
Note on terminologyThe access token is sometimes also called bearer token, since the Authentication uses the standard HTTP Bearer scheme.
Your calls need other headers besides these two — see IXON API prerequisites for the full set.
How to get an Application ID
All endpoints can solely be reached when a valid Application ID is provided. It can be obtained by creating a Service Account: this Application ID appears during the creation of a new Service Account in the IXON Portal, together with the Service Account access token. Check Service Accounts access tokens for more information.
How to get an access token
Access Tokens identify who your calls are made as — a company-scoped integration, or a user.
Additionally, they determine:
- Whose permissions the request runs with
- Which devices and data it can see
- Whose name appears in the audit trail
There are two types of access tokens:
-
Service Account access token (Recommended): acts as a Service Account, and never expires. It's created together with its Application ID in the IXON Portal, so this one route gives you both credentials at once. Check How to create a Service Account for more information.
-
User access token: acts as a specific IXON Cloud user, and expires between 60 seconds and 60 days after it's created. Your integration can request one from the AccessTokenList endpoint whenever it needs it. Check How to create a user access token for more information.
Note on Service Account access tokensA Service Account access token is bound to the Application ID it was created with — it will not work alongside another Service Account's Application ID.
Which access token should you use?
There are two possibilites:
- Get a Service Account access token if your integration authenticates as an application rather than as a person — every call is made by the integration itself. This option is recommended.
- Get a user access token if your integration has to act as a specific named user. The typical case is building a login flow into your own application: your users sign in with their IXON Cloud credentials, and each API call then has to be made as the person who signed in, with their permissions and their audit trail. A Service Account access token can't do this because it has no identity to log in as.
- This route is also required for the endpoints that Service Accounts don't support.
Updated 44 minutes ago