---
updatedAt: 2026-05-08T04:39:59.000Z
agentTools:
  projectIndex: https://gethapn.readme.io/llms.txt
---

# Authentication

Hapn API authentication uses OAuth 2.0 Bearer tokens to secure API endpoints. Clients exchange credentials for a short-lived token, then include that token on each request to protected resources.

To issue API requests, you'll need a `clientId` and `clientSecret` provisioned by our Customer Success team.

## Requesting an Access Token

POST your client credentials to the authorization endpoint at <https://auth.usehapn.com/oauth2/token>:

```bash
curl --location --request POST 'https://auth.usehapn.com/oauth2/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=<CLIENT_ID>' \
  --data-urlencode 'client_secret=<CLIENT_SECRET>'
```

Replace `<CLIENT_ID>` and `<CLIENT_SECRET>` with the credentials issued to you.

Response:

```json
{
  "access_token": "ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

The token is valid for one hour (`expires_in` is in seconds).

## Authenticating Requests

Send the token in the `Authorization` header on every request:

```
Authorization: Bearer <ACCESS_TOKEN>
```

Example:

```bash
curl --request GET \
  --url https://api.iotgps.io/v1/devices \
  --header 'Authorization: Bearer <ACCESS_TOKEN>' \
  --header 'Accept: application/json'
```

## 🔐 Best Practices

* **Keep tokens secret.** Treat Bearer tokens like passwords — never commit them, log them, or share them.
* **Refresh before expiry.** Tokens expire after one hour. Request a new one before the current token expires to avoid authentication errors mid-request.
* **Request tokens on demand.** You can fetch a new token at any time, even while an existing one is still valid. token before the previously issued token has expired