Authentication

Casap gives you a ready-made token at onboarding. Send it unchanged on every request:

Authorization: Bearer N2M0ZjJlOTEtNWQ4My00YTZiLTlmMDEtMmI4ZTZjM2Q1YTc0OktxMy1abTlUcFI0dlQ4c0tkSjF5V2JONmVIM3VBOWZDZ1hvVl9QMHJTdDU=

There is no login call and nothing to refresh. The same value goes on every request.

A complete request, against sandbox:

curl 'https://api-sandbox.casaphq.com/v1/accounts?customerUuid=2f6d8b14-70a3-4c92-8de5-61b4a0c37e28' \
  -H 'Authorization: Bearer N2M0ZjJlOTEtNWQ4My00YTZiLTlmMDEtMmI4ZTZjM2Q1YTc0OktxMy1abTlUcFI0dlQ4c0tkSjF5V2JONmVIM3VBOWZDZ1hvVl9QMHJTdDU='

The token above is an example. It has the same shape as yours and does not authenticate.

Two things that break it

Copy it whole. The token is 108 characters and ends in =. Dropping the padding or losing a character to a copy and paste gives a 401 that looks the same as a wrong secret.

The scheme is Bearer, not Basic. The token is base64 of a name:secret pair, so an HTTP client's basic-auth helper produces the identical value and then sends it as Authorization: Basic. That is refused. Set the header yourself.

What is inside it

Useful when a call is refused and you want to check the value you hold. Base64 decode the token and you get your org uuid, a colon, and your secret:

7c4f2e91-5d83-4a6b-9f01-2b8e6c3d5a74:Kq3-Zm9TpR4vT8sKdJ1yWbN6eH3uA9fCgXoV_P0rSt5

The org uuid is a uuid and the secret is 43 characters. If onboarding handed you those two parts instead of a token, the token is base64(org_uuid:secret), standard alphabet, padding kept.

What the token identifies

Authorization is the only header authentication reads. The token resolves to your organization, and the call acts as the guest user Casap provisions for it. You do not send a user of your own.

The secret

The token is static. It does not expire and is not rotated on a schedule. Casap can issue a new one on request, and the old value stops working the moment the new one is in place.

Keep it server-side. It authenticates as your whole organization, so it does not belong in a browser, a mobile app, or anything else a member can read.

Sandbox and production have separate credentials. A sandbox token does not authenticate in production. See Environments.

When authentication fails

The response body names the specific problem:

Response	Cause
`401 authorization header required`	The header is missing.
`401 request unauthenticated with bearer`	The scheme is not `Bearer`.
`401 failed to decode token`	The token is not valid base64. Usually a truncated copy.
`401 invalid token format`	The decoded value has no colon in it.
`401 invalid secret`	The token does not match the one on file for that org.
`401 no guest user provisioned`	The credential is valid but the org's setup is incomplete. Contact Casap.

Introduction

Environments