# REST API: authentication and keys

The live server API is under `/api/thirdparty`. It authenticates with a `gn-access-token` that you get by exchanging your brand's `api_key` and `api_secret`; the token acts as your brand's owner account. Full reference: [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api) (token) and [Handle API errors](https://begenuin.com/developers/developer-resources/api/handle-api-errors) (errors); environments and credentials: [Environments, credentials, and test data](https://begenuin.com/developers/developer-resources/guides/environments-credentials-and-test-data).

| Environment | Base URL |
| --- | --- |
| Production | https://api.begenuin.com |
| QA | https://api.qa.begenuin.com |

## Get a token

```bash title="cURL"
curl -i -X POST https://api.begenuin.com/api/thirdparty/auth \
  -H "Content-Type: application/json" \
  -d '{ "api_key": "<<YOUR_API_KEY>>", "api_secret": "<<YOUR_API_SECRET>>" }'
```

The token is returned in the `gn-access-token` response header, with a `gn-refresh-token`. Access tokens last 14 days in Production and 3 hours in QA; refresh tokens last 100 days and 24 hours. Refresh with `POST /api/v4/auth/session/refresh` and the refresh token as the bearer.

## Use it

```bash title="cURL"
curl -X POST https://api.begenuin.com/api/thirdparty/community/create \
  -H "Authorization: Bearer {{GN_ACCESS_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "handle": "{{COMMUNITY_HANDLE}}", "name": "{{COMMUNITY_NAME}}" }'
```

## Credentials

| Credential | Issued by | Use |
| --- | --- | --- |
| api_key (48 hex) and api_secret (32 hex) | The Genuin team, one pair per brand and environment | Server only; exchanged for a token |
| Brand API key | Brand Control Center (BCC) › Build › Publish Communities › SDK Integration | SDKs, and the Delete member endpoint (see [Delete a member account](https://begenuin.com/developers/developer-resources/api/delete-a-member-account)) |

To rotate the pair, contact the Genuin team; the old pair stops working when the new one is issued.

**Endpoints live today** – communities (see [Create a community](https://begenuin.com/developers/developer-resources/api/create-a-community-programmatically-using-community-api)), groups (see [Create a group in a community](https://begenuin.com/developers/developer-resources/api/create-a-group-programmatically-within-community-using-create-group-api)), members (see [Add members to a community](https://begenuin.com/developers/developer-resources/api/add-members-to-a-community-programmatically-api)), moderators (see [Add moderators to a community](https://begenuin.com/developers/developer-resources/api/assign-moderators-to-community-using-api)), group updates (see [Update a group and its members](https://begenuin.com/developers/developer-resources/api/add-or-manage-group-members-collaborators-using-api)), member deletion (see [Delete a member account](https://begenuin.com/developers/developer-resources/api/delete-a-member-account)), and video posts (see [Post a video to a group](https://begenuin.com/developers/developer-resources/api/post-and-share-a-video-within-a-group-using-the-post-video-api)). The full Business Account resource map proposed for v1 is in [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map), and [Live API today and the Business Account API roadmap](https://begenuin.com/developers/developer-resources/guides/live-api-today-and-the-business-account-api-roadmap) shows which parts are live.

**Errors** – every error has an HTTP status, a string `code`, a `message`, and a `data` object; match on `code` (see [Handle API errors](https://begenuin.com/developers/developer-resources/api/handle-api-errors)).

## API & SDK

Access: the calls in the table are the proposed Business Account API (see [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map)), authenticated with a key scoped to the account and a role or an OAuth client acting for it; every confirmation in this article becomes a proposal you can approve by API (`POST /proposals/{proposalId}:approve`). Live today, the server API under `/api/thirdparty` authenticates with a `gn-access-token` (see [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api)), and [Live API today and the Business Account API roadmap](https://begenuin.com/developers/developer-resources/guides/live-api-today-and-the-business-account-api-roadmap) maps what is live to what is proposed.

| Call | Purpose |
| --- | --- |
| POST /oauth/token | Exchange client credentials for an access token scoped to a Business Account |
| POST /accounts/{accountId}/keys | Issue a key with a role scope (sandbox or live) |
| POST /keys/{keyId}:rotate | Rotate a key; the old key keeps working for 24 hours |
| GET /accounts/{accountId} | Read the Business Account: plan, brands, roles, verification state |

```js
// proposed server SDK (Business Account API)
import { Genuin } from '@genuin/sdk';
const genuin = new Genuin({ apiKey: process.env.GENUIN_KEY });
await genuin.auth.token({ clientId, clientSecret, accountId, scope });
await genuin.keys.create(accountId, { env: 'live', role: 'developer' });
await genuin.keys.rotate(keyId);
```

Live today: [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api) · [Environments, credentials, and test data](https://begenuin.com/developers/developer-resources/guides/environments-credentials-and-test-data).

SDKs: Web SDK (see [Embed the Genuin Web SDK on your website](https://begenuin.com/developers/developer-resources/sdk/how-do-you-embed-and-configure-the-genuin-web-sdk-on-your-website)), iOS SDK (see [Integrate the Genuin iOS SDK](https://begenuin.com/developers/developer-resources/sdk/developer/genuin-sdk/native-compatibility/ios/how-to-integrate-and-power-your-brand-community-in-ios-apps)), Android SDK (see [Integrate the Genuin Android SDK](https://begenuin.com/developers/developer-resources/sdk/how-to-integrate-and-power-your-brand-community-in-android-apps)), React Native (see [Integrate the Genuin SDK with React Native apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-react-native-sdk-into-your-application)), and Flutter (see [Integrate the Genuin SDK with Flutter apps](https://begenuin.com/developers/developer-resources/sdk/how-do-you-integrate-the-genuin-flutter-sdk-into-your-application)) render Genuin and sign members in; the Node (`@genuin/sdk`) and Python (`genuin`) server SDKs are proposed with [Business Account API: provisioning, OAuth, and the resource map](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map).