--- title: "Authentication & Authorization" slug: "authentication-authorization-2" updated: 2025-08-26T17:46:58Z published: 2025-08-26T18:39:33Z canonical: "guide.youraspire.com/authentication-authorization-2" --- > ## Documentation Index > Fetch the complete documentation index at: https://guide.youraspire.com/llms.txt > Use this file to discover all available pages before exploring further. # Authentication & Authorization The API is secured to ensure that only authorized users can access the endpoints they have been provisioned to access. The Aspire External API uses [Bearer Authentication](https://swagger.io/docs/specification/authentication/bearer-authentication/) to provide a subscription-based security method using a bearer token. To use the API, you must generate a Client ID and Key to obtain an access token. ## **Requirements** Authentication requires: - An Aspire user account with [Admin permissions](https://guide.youraspire.com/docs/admin-permissions) to log in to Aspire. - Once logged in, API credentials need to be created for authentication. For more information, see [API Search List Screen](https://guide.youraspire.com/docs/application-programming-interface). - Create an access token via the [POST/Authorization](https://guide.youraspire.com/apidocs/authorization-1) endpoint using the API credentials (**Client ID** and **Secret)**. This token will then authorize access to endpoints available to the logged-in user. ## **Authenticate** An admin user within the Aspire desktop application must create credentials for the API user by following these steps: 1. Go to the Aspire application and select Administration > Application > API > New. 1. Create a Description that appropriately describes the user or the specified purpose for the set of credentials. 2. Copy the Client ID and Secret and store it where you can retrieve it later.IMPORTANT: Losing your Client ID and Secret will require you to regenerate a new one and update any integration currently using the previous credentials. 3. Select the endpoints that you want to provide access to under the Scope section. 4. Select Save. ## **Authorize** Use authentication credentials to generate an access token ([JWT](https://jwt.io/introduction)) to be placed in the header of all requests. #### #### API Guide Authorization Use the following steps to create an access token from the API Guide: 1. Go to the POST/Authorization [endpoint](https://cloud-api.youraspire.com/swagger/index.html). 2. Enter the ClientId and Secret and click Try It!Since the "Token" **under the "Authentication" section of the interactive console** is required, enter "123" in this field. The only purpose of this workaround is to enable the "Try It" button after entering your credentials. It can not be used to authorize the use of endpoints. You will use the *Toke*n generated in the "Body" of the interactive console for authorization. 3. With a success (200) status code, you should see the value of the token and refresh the token in the response body. Copy the entire token string. 1. Do not copy the RefreshToken string or the quotations. Copy the  RefreshToken separately and paste it somewhere secure so you will have it to refresh the token later. 2. Ensure quotes are enclosed. 4. Copy the token value, select an endpoint to interact with, and enter the value in the Token field under **Authentication** for the endpoint you have selected. 1. After entering information within the query or body parameters of the endpoint selected, click **Try It** to commit the changes. Once submitted, the token will automatically populate under all available endpoints you interact with until the token expires.  ![](https://cdn.document360.io/5942a8d7-f3b1-4919-bdfa-d477d8498fe3/Images/Documentation/image-1705608867952.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A47%3A16Z&se=2026-11-15T01%3A47%3A16Z&sr=c&sp=r&sig=XXzz73cvxdAE2Ki24tAf8Egg%2Bop2oW3PTS63kwcaXTs%3D) #### #### Swagger UI Authorization Use the following steps to create an access token using the Swagger UI. 1. Go to the [Swagger UI](https://cloudsandbox-api.youraspire.com/swagger/index.html) tool. 2. Expand the [POST/Authorization](https://guide.youraspire.com/apidocs/authorization-1) endpoint and select Try It Out. 3. Enter the ClientId and Secret > Execute. 1. Ensure quotes are enclosed. 1. With a success status code, you should see the token's value and refresh the token in the response body. Copy the entire Token string. 1. Do not copy the RefreshToken string or the quotations. Copy this section separately and paste it somewhere secure to use the string to refresh the token later. ![](https://cdn.document360.io/5942a8d7-f3b1-4919-bdfa-d477d8498fe3/Images/Documentation/image-1704705901125.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A47%3A16Z&se=2026-11-15T01%3A47%3A16Z&sr=c&sp=r&sig=XXzz73cvxdAE2Ki24tAf8Egg%2Bop2oW3PTS63kwcaXTs%3D) 1. Select Authorize in the top right corner of the screen, paste the copied Token value in the Bearer Authorization Token Value field, and select Authorize. 1. The padlock icon within the SwaggerUI will appear locked once the token is saved. ### **R****efresh Token** Use this token value with the [**POST**/Authorization/RefreshToken](https://guide.youraspire.com/apidocs/authorizationrefreshtoken) endpoint to refresh usage for another 24 hours before the expiration of your token. ### **Token Expiration** Tokens generated through the API are valid for 24 hours from the time they are issued. This expiration period is fixed, making additional API requests during that window does **not** extend or reset the token’s lifespan. Once a token expires, you must either: - Generate a new token by calling the `POST /Authorization` endpoint again, **or** - Use the refresh token from the original authorization request to call the `POST /Authorization/RefreshToken` endpoint, which will return both a new access token and a new refresh token. Keep in mind that refresh tokens also have an expiration period. If the refresh token has expired, you'll need to repeat the full authorization flow. A unique identifier assigned to a client application in authentication and authorization systems, often used in protocols like OAuth. AKA a secret key. It is an encrypted key, used for securing and authorizing communication between systems.