Each and every API key is bound to a single JustRelate account, and within this account to a specific user. The maximum number of API keys per user is 20.
If you add an API key to an account of yours, it will be generated for you, including a secret. Your code can then provide these credentials to IAM’s token endpoint for authentication. If successful, the token endpoint returns an access token for issuing requests to any API endpoint the product or service in your account offers.
IAM access tokens expire 15 minutes after they were issued. Attempting to access an API endpoint with an expired token results in an HTTP 401 error in the response, meaning that a new token needs to be obtained to be able to repeat the request and issue follow-up requests.
Every request issued using an API key is processed in the name of the user to which the key belongs. This means that any action performed, e.g. creating, updating or deleting a mailing, a CMS object, etc., is subject to this user’s permissions, but also that the action is attributed to this user, which can be seen in the UI of your product.
For this reason, it is advisable to have any automated task executed by a special user that has been created only for this purpose and has exactly the permissions required for executing it.
As an example, assume that you’ve requested an API key for your client titled “MyApp” and were given the following:
exampleclientid321ex/amp/lpe/client/secret2342You can now have IAM generate an access token:
curl -XPOST --data "grant_type=client_credentials&client_id=exampleclientid321&client_secret=ex/amp/lpe/client/secret2342" https://api.justrelate.com/iam/token
Afterwards, you can use this token to access your Neoletter instance, for example, like so:
curl -H "Authorization: Bearer example_access_token_123" https://api.justrelate.com/neoletter/instances/instance_id/form_submissions
Further reading