Authentication

Hapn API authentication uses OAuth 2.0 Bearer tokens to secure API endpoints. Clients exchange credentials for a short-lived token, then include that token on each request to protected resources.

To issue API requests, you'll need a clientId and clientSecret provisioned by our Customer Success team.

Requesting an Access Token

POST your client credentials to the authorization endpoint at https://auth.usehapn.com/oauth2/token:

Bash

curl --location --request POST 'https://auth.usehapn.com/oauth2/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=<CLIENT_ID>' \
  --data-urlencode 'client_secret=<CLIENT_SECRET>'

Replace <CLIENT_ID> and <CLIENT_SECRET> with the credentials issued to you.

Response:

JSON

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600
}

The token is valid for one hour (expires_in is in seconds).

Authenticating Requests

Send the token in the Authorization header on every request:

Authorization: Bearer <ACCESS_TOKEN>

Example:

Bash

curl --request GET \
  --url https://api.iotgps.io/v1/devices \
  --header 'Authorization: Bearer <ACCESS_TOKEN>' \
  --header 'Accept: application/json'

🔐 Best Practices

• Keep tokens secret. Treat Bearer tokens like passwords — never commit them, log them, or share them.
• Refresh before expiry. Tokens expire after one hour. Request a new one before the current token expires to avoid authentication errors mid-request.
• Request tokens on demand. You can fetch a new token at any time, even while an existing one is still valid. token before the previously issued token has expired