> ## Documentation Index
> Fetch the complete documentation index at: https://www.bloxs.io/llms.txt
> Use this file to discover all available pages before exploring further.
# /Authorization
## OpenAPI
````json POST /Authorization
{
"openapi": "3.0.4",
"info": {
"title": "Authorization",
"description": "This is an endpoint to request your JWT token and verify the connection and authorization is working correctly.\n\nThe authorization token consists of 2 things: an API key, API Secret\n##### API Key\nThe API Key belongs to an user within the client application where the connection is made to.\nThis key is used to identify the user and is part of the generated token.\n##### API Secret\nThe API Secret belongs to the client application where the connection is made to.\nThis secret is used to hash the token parts into the authorization token.\n",
"version": "v1"
},
"security": [
{}
],
"tags": [
{
"name": "Authorization"
},
{
"name": "Metadata"
},
{
"name": "Test"
}
],
"paths": {
"/Authorization": {
"post": {
"tags": [
"Authorization"
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GenerateTokenModel"
}
}
}
},
"responses": {
"200": {
"description": "The authorization token created",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/JWTTokenInfo"
}
}
}
},
"400": {
"description": "The authorization token can't be created"
}
},
"x-d360-narrative-url": "Authorization
The Authorization endpoint issues a JWT access token used to authenticate all subsequent requests to the Bloxs API. A developer calls this endpoint once at the start of an integration session, or whenever the current token has expired, to exchange an API Key and API Secret for a bearer token. The API Key identifies the specific user within the client application, while the API Secret belongs to the client application itself and is used to sign the token; both are required to generate a valid token.
Request Fields
Field | Type | Required | Description |
|---|
apiKey | string | Yes | Identifies the user within the client application making the request. Minimum length of 1 character. |
apiSecret | string | Yes | Secret belonging to the client application, used to sign the generated token. Minimum length of 1 character. |
Response Fields
Field | Type | Required | Description |
|---|
token | string | No | The generated JWT bearer token. Include this in the Authorization header (as Bearer {token}) on subsequent API calls. Nullable, returned empty if the request fails. |
expiration | string (date-time) | Yes | Expiration timestamp of the token, in GMT, valid for 24 hours from issuance. Format is ISO 8601 date-time, e.g. 2026-08-13T14:30:00Z. Requests made after this time require a new token. |