Skip to main content

Fulfillment API: Authentication

Raj
Updated

Q: How do I authenticate with the Acutrack API and get access to its resources?

A: All Acutrack APIs are only accessible after successful authentication. Authentication uses your Acutrack-issued user credentials (username and password), which are exchanged for a bearer access token that you then attach to every API request. The full process has five parts, described below.

1. Generate your password

Acutrack will send an email to your dedicated API user email address containing an activation link. Use that link to set up your password.

Your username and password are private and must not be shared. This API user account exists solely for accessing Acutrack APIs — it cannot be used to log in to the Acutrack portal; portal access is denied for this user.

2. Request an access token

To access any Acutrack API resource, you must first exchange your username and password for an access token. Do this by sending a POST request to the token endpoint: 

POST https://fulfillmentapi.acutrack.com/api/Authentication/authenticate

Request body:

{
  "userName": "email@domain.com",
  "password": "password"
}

An access token is valid for 60 minutes. Once it expires, any API call made with it will fail with a 401 error and the message "The token is expired." At that point a new access token must be obtained. You do not need to request a new token for every request — only once it is close to expiring.

Recommendation: refresh the access token periodically, roughly every 45–50 minutes, so that no resource request is ever made with an expired token.

3. Receive your tokens

If the credentials in the request are valid, the token endpoint returns your access token along with related account details. The response contains:

  • token — the access token used to call the API.
  • refreshToken — used to regenerate a new access token once the current one expires.
  • companies[].id — the ClientId to use in every Order and Product API call.
  • companies[].gatewayId — the GatewayId to use in every Order and Product API call.
  • companies[].storeName — the StoreName to use in every Order and Product API call.

Example response:

{
  "id": 1,
  "userName": "email@domain.com",
  "token": "accesstoken123%67983",
  "refreshToken": "refreshToken123%sxs=",
  "companies": [
    {
      "id": 0,
      "company": "CompanyName",
      "gatewayId": 4,
      "storeName": "clientStoreName",
      "isDefault": true
    }
  ]
}

4. Call the API

Once you have an access token, every subsequent resource request must include it as a Bearer token in the Authorization header — the word "Bearer", a space, then the token value.

For example, if the access token is eXFWWERlC8wafnWgAlgqxagATPF0F, the header is: 

Authorization: Bearer eXFWWERlC8wafnWgAlgqxagATPF0F

Add this header (along with an Accept header) to every API call, for example: 

GET https://fulfillmentapi.acutrack.com/ProductInventoryStockDetails/{clientId}
Authorization: Bearer <token>
Accept: application/json

5. Refresh the token

Before an access token expires, use the refresh token to obtain a new one without re-authenticating with your username and password: 

POST https://fulfillmentapi.acutrack.com/api/Authentication/RefreshToken

Headers:

Authorization: Bearer <token>
Accept: application/json

Request body:

{
  "jwtToken": "string",
  "refreshToken": "string"
}

Here, jwtToken is the current (soon-to-expire) access token, and refreshToken is the refresh token received in the original authentication response.

Related articles