Skip to content
KivraDevelopers
This is a new version of the Kivra Developer Docs. Report issues or share feedback at avsandare.support@kivra.se. The previous version can be found here.

Authentication

The Partner API uses OAuth 2.0 client credentials. Kivra provides a client_id and client_secret that identify your organisation as a partner. The access token identifies your client and nothing more: which companies you may read is decided by the companies themselves, as described in the Integration guide. A request for a company that has not activated an integration with you is rejected even when the token itself is valid.

The token endpoint is shared with the Tenant API and is also described in the API reference.

Encode the credentials without a trailing newline and request a token:

Terminal window
BASE64_CREDENTIALS=$(printf '%s' "$KIVRA_CLIENT_ID:$KIVRA_CLIENT_SECRET" | base64)


curl -X POST \
  "https://sender.sandbox-api.kivra.com/v1/auth" \
  -H "Authorization: Basic $BASE64_CREDENTIALS" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials"

Send the returned token with every Partner API request:

Authorization: Bearer <access_token>

The response’s expires_in tells you how long the token is valid, in seconds. Reuse a token until shortly before it expires rather than requesting one per call.