Authentication

Every request on this API must have a header "Authorization" with a bearer token :

Authorization: Bearer {token}

Generate a token : oAuth2.0

This API implements the protocol oAuth2.0 for the authentication and token generation. It means that we first need to generate a client_id and client_secret to authenticate your calling application. Your application information will be sent by a secure way.

Auth URL : https://api.progbat.com/v2/auth

Token URL: https://api.progbat.com/v2/token

Step1 - Authenticate the user

To generate a user token, your must first redirect the user to https://api.progbat.com/v2/auth with the following query parameters :

Parameter	Required	Description
client_id	✅	The id of your application (provided by our team).
scope	✅	The scopes you want access with the token that will be generated, comma separated.
response_type	✅	Must be the string "code"
redirect_uri	✅	The endpoint the user will be redirected after authentication. On this endpoint, the token will be generated.
state	✅	A random string that will be returned to redirect_uri to ensure the authentication process security
pompt		"login" to force the user to login event if already logged in on the browser "select_account" (default) to let user select its logged account "consent" to display the validation scope page "none" to pass throw all steps if the user is alraedy logged in and have accepted the scopes

Step 2 : Generate a token

Once the user is authenticated and has validated the scope to accept your application access to his data on ProGBat, it will be redirected to the provided redirect_uri.

To generate the token, make a request POST https://api.progbat.com/v2/token. with the following body (JOSN or form urlencoded are accepted):

{
  "client_id" : "{your client id}",
  "client_secret" : "{your client secret}",
  "grant_type": "authorization_code",
  "code" : "{The code received by query string}",
  "redirect_uri" : "{The same redirect_uri as provided on authentication page}"
}

The response will be a JSON like

{
  "access_token": "string",
  "refresh_token": "string",
  "token_type": "string",
  "expires_in": 0
}

The property access_token has to be set in the next API calls, in the header Authorization: Bearer {access_token}

The property refresh_token has to be stored on your system, to be used to refresh token later.

Refresh a token

When generating token from an authorization code, an access_token and a refresh_token are returned by the API. The refresh_token can be stored in your system to generate a new token later, without user authentication.

To refresh a token, make a request POST https://api.progbat.com/v2/token with the following body :

{
  "client_id" : "{your client id}",
  "client_secret" : "{your client secret}",
  "grant_type": "refresh_token",
  "refresh_token": "{The stored refresh_token}"
}

A refresh token can be used 50 times before expiration. At the 50th usage, a nex refresh_token is created and the old one is invalidated. It means that you need to store the new returned refresh_token for your future requests.