REST API: authentication and keys
The live server API is under /api/thirdparty. It authenticates with a gn-access-token that you get by exchanging your brand's api_key and api_secret; the token acts as your brand's owner account. Full reference: Generate an access token (token) and Handle API errors (errors); environments and credentials: Environments, credentials, and test data.
| Environment | Base URL |
|---|---|
| Production | https://api.begenuin.com |
| QA | https://api.qa.begenuin.com |
Get a token
curl -i -X POST https://api.begenuin.com/api/thirdparty/auth \
-H "Content-Type: application/json" \
-d '{ "api_key": "<<YOUR_API_KEY>>", "api_secret": "<<YOUR_API_SECRET>>" }'The token is returned in the gn-access-token response header, with a gn-refresh-token. Access tokens last 14 days in Production and 3 hours in QA; refresh tokens last 100 days and 24 hours. Refresh with POST /api/v4/auth/session/refresh and the refresh token as the bearer.
Use it
curl -X POST https://api.begenuin.com/api/thirdparty/community/create \
-H "Authorization: Bearer {{GN_ACCESS_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "handle": "{{COMMUNITY_HANDLE}}", "name": "{{COMMUNITY_NAME}}" }'Credentials
| Credential | Issued by | Use |
|---|---|---|
| api_key (48 hex) and api_secret (32 hex) | The Genuin team, one pair per brand and environment | Server only; exchanged for a token |
| Brand API key | BCC › Build › Publish Communities › SDK Integration | SDKs, and the Delete member endpoint (see Delete a member account) |
To rotate the pair, contact the Genuin team; the old pair stops working when the new one is issued.
Endpoints live today – communities (see Create a community), groups (see Create a group in a community), members (see Add members to a community), moderators (see Add moderators to a community), group updates (see Update a group and its members), member deletion (see Delete a member account), and video posts (see Post a video to a group). The full Business Account resource map proposed for v1 is in Business Account API: provisioning, OAuth, and the resource map, and Live API today and the Business Account API roadmap shows which parts are live.
Errors – every error has an HTTP status, a string code, a message, and a data object; match on code (see Handle API errors).
API & SDK
Access: the calls in the table are the proposed Business Account API (see Business Account API: provisioning, OAuth, and the resource map), authenticated with a key scoped to the account and a role or an OAuth client acting for it; every confirmation in this article becomes a proposal you can approve by API (POST /proposals/{proposalId}:approve). Live today, the server API under /api/thirdparty authenticates with a gn-access-token (see Generate an access token), and Live API today and the Business Account API roadmap maps what is live to what is proposed.
| Call | Purpose |
|---|---|
| POST /oauth/token | Exchange client credentials for an access token scoped to a Business Account |
| POST /accounts/{accountId}/keys | Issue a key with a role scope (sandbox or live) |
| POST /keys/{keyId}:rotate | Rotate a key; the old key keeps working for 24 hours |
| GET /accounts/{accountId} | Read the Business Account: plan, brands, roles, verification state |
// proposed server SDK (Business Account API)
import { Genuin } from '@genuin/sdk';
const genuin = new Genuin({ apiKey: process.env.GENUIN_KEY });
await genuin.auth.token({ clientId, clientSecret, accountId, scope });
await genuin.keys.create(accountId, { env: 'live', role: 'developer' });
await genuin.keys.rotate(keyId);Live today: Generate an access token · Environments, credentials, and test data.
SDKs: Web SDK 2.0.6 (see Embed the Genuin Web SDK on your website), iOS SDK 2.1.5 (see Integrate the Genuin iOS SDK), Android SDK 2.1.5 (see Integrate the Genuin Android SDK), React Native 3.0.3 (see Integrate the Genuin SDK with React Native apps), and Flutter (see Integrate the Genuin SDK with Flutter apps) render Genuin and sign members in; the Node (@genuin/sdk) and Python (genuin) server SDKs are proposed with Business Account API: provisioning, OAuth, and the resource map.
