# Authentication

The API uses OAuth2 bearer tokens.

1. Combine your client ID and secret as `client_id:secret` and encode the result in
   base64.
2. Call `POST /api/oauth/v1/retailer/token` with that value in an
   `Authorization: Basic <base64>` header. You do not need a username or a password.
3. Send the `access_token` from the response on every other request, in an
   `Authorization: Bearer <access_token>` header.
4. The token expires after `expires_in` seconds. Request a new one with the
   `refresh_token` (grant type `refresh_token`), or simply request a new token as in step 2.

A missing, invalid or expired token is answered with `401`.

The token is linked to your partner account. All product endpoints only show and change
**your own** products; you never have to send your partner code yourself.