OAuth Authentication
Tuned Global uses OAuth 2.0 for user authentication. All Services API access is managed through short-lived JWTs (access tokens) and longer-lived refresh tokens. Token lifetimes are returned in each authentication response.
There are four ways to obtain a Tuned Global access token using OAuth 2.0. Email Login and Mobile Login sign in a user who has already registered with Tuned Global; neither one creates an account. Refresh Token renews an existing session without asking the user to sign in again. Third-party JWT exchanges an identity token your own system already issued for one of ours, for users authenticated outside Tuned Global entirely. See detail below
- Email Login Authenticate with an email address and password that the user already registered with Tuned Global through email registration. This call only signs the user in, it does not create an account, so calling it with an email that was never registered fails. On success, the response includes an access token for calling Services APIs on the user's behalf, and a refresh token for renewing that access later without asking the user to sign in again.
- Refresh Token Exchange a refresh token for a new access token once the current one expires, without asking the user to sign in again. Access tokens are valid for 1 hour. Refresh tokens are valid for 7 days. Call this endpoint before the refresh token itself expires. Once it expires, the user has to sign in again through Email Login or Mobile Login.
- Mobile Login Authenticate with a mobile number using a one-time passcode (OTP). Like Email Login, this call only signs the user in: the number must already be registered with Tuned Global. The flow has two steps:
- Request a code for the number by calling Request OTP. Tuned Global sends it by SMS, either through Firebase (the default, capped at 10,000 verifications a month) or through the store's own telco or SMS vendor if one is configured instead.
- Call Mobile Login with the same msisdn and the code the user received, to exchange it for an access token.
- Third-party JWT validation Validate a JWT that a third party already issued and signed, using the asymmetric RS256 algorithm. The client generates its own key pair, signs the token with the private key, and Tuned Global validates it with the matching public key to extract the user's claims. This only works once Tuned Global holds that client's public key. Share your public key with your Tuned Global integration contact first. Once it is installed for your store, calls to this endpoint succeed. There is no self-service way to register a key through the API itself.
Requesting a token - code samples:
Email Login - Code Samples
Email Login - Code Samples
JavaScript
JavaScript
const response = await fetch('https://api-authentication-connect.tunedglobal.com/oauth2/token', {
method: 'POST',
headers: {
'StoreId': 'TEST',
'Content-Type': 'application/x-www-form-urlencoded'
},
body: new URLSearchParams({
grant_type: 'password',
username: 'xxxx',
password: 'xxxxx'
})
});
const data = await response.json();
console.log(data.access_toke
Python
import requests
response = requests.post(
'https://api-authentication-connect.tunedglobal.com/oauth2/token',
headers={'StoreId': 'TEST'},
data={
'grant_type': 'password',
'username': 'xxxx',
'password': 'xxxxx'
}
)
data = response.json()
print(data['access_token'])ema
Response
JSON
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
Refresh Token - Code samples
Refresh Token - Code samples
JavaScript
const response = await fetch('https://api-authentication-connect.tunedglobal.com/oauth2/token', {
method: 'POST',
headers: {
'StoreId': 'TEST',
'Content-Type': 'application/x-www-form-urlencoded'
},
body: new URLSearchParams({
grant_type: 'refresh_token',
refresh_token: 'xxxxx'
})
});
const data = await response.json();
console.log(data.access_token);
Python
import requests
response = requests.post(
'https://api-authentication-connect.tunedglobal.com/oauth2/token',
headers={'StoreId': 'TEST'},
data={
'grant_type': 'refresh_token',
'refresh_token': 'xxxxx'
}
)
data = response.json()
print(data['access_token'])
Response
JSON
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
Mobile Login - Code samples
Mobile Login - Code samples
JavaScript
const response = await fetch('https://api-authentication-connect.tunedglobal.com/oauth2/token', {
method: 'POST',
headers: {
'StoreId': 'TEST',
'Content-Type': 'application/x-www-form-urlencoded'
},
body: new URLSearchParams({
grant_type: 'msisdn',
msisdn: '6112345678',
code: '123456789'
})
});
const data = await response.json();
console.log(data.access_token);
Python
import requests
response = requests.post(
'https://api-authentication-connect.tunedglobal.com/oauth2/token',
headers={'StoreId': 'TEST'},
data={
'grant_type': 'msisdn',
'msisdn': '6112345678',
'code': '123456789'
}
)
data = response.json()
print(data['access_token'])
JSON
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
Third-party JWT validation - Code samples
Third-party JWT validation - Code samples
JavaScript
const response = await fetch('https://api-services-connect.tunedglobal.com/api/v3/users/authenticateThirdPartyJWT', {
method: 'POST',
headers: {
'StoreId': 'TEST',
'Authorization': 'Bearer <Client_JWT>'
}
});
const data = await response.json();
console.log(data.access_token);
Python
import requests
response = requests.post(
'https://api-services-connect.tunedglobal.com/api/v3/users/authenticateThirdPartyJWT',
headers={
'StoreId': 'TEST',
'Authorization': 'Bearer <Client_JWT>'
}
)
data = response.json()
print(data['access_token'])
JSON
{
"access_token": "••••••••••••••••",
"token_type": "bearer",
"expires_in": 300,
"refresh_token": "••••••••••••••••"
}
Was this section helpful?
Status Codes
200
Everything worked as expected.
400
The request was unacceptable, often due to missing a required parameter.
401
The request was unacceptable, often due to missing a required parameter.
402
The parameters were valid but the request failed.
403
The API key doesnt have permissions to perform the request.
404
The requested resource does not exist.
Was this section helpful?