Machine to Machine (Unbound Access)
Get Machine-To-Machine Token
The machine-to-machine token can be used against USTA APIs/services which are not related to customer session. This method uses the Client_Credentials Grant Type. This grant type does not return a Refresh Token. Instead you must retrieve another Access Token,
To obtain such token API Client should call
POST: https://stage-account.usta.com /oauth2/token?grant_type=client_credentials
and pass API Client credentials by standard Basic Authentication header:
Base64encoded: {clientId}:{secret}
without a body in the request.
HEADERS:
Authorization: Basic <access token>
EXAMPLE:
curl --location --request POST 'https://stage-account.usta.com/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic MWxhMWNwZmJsdWhlaDRqa3I4ZHN2ZGdyMzI6cXQwZTM3OWdnaHB2NWRpdG8ybzBsYmpxc2M1cjYwaWVvaGNkNG1mOHN2b2UwcW9yMjlv' \
--data-urlencode 'grant_type=client_credentials'Working With JWT Tokens
JWT tokens are encrypted JSON format and contain fields called claims. Once you generate an Access Token, you can examine the contents at http://jwt.io . This is a valuable debugging tool.
Check For 401 Status Response To Determine Whether To Request A New Access Token
One simple way t deterine if the Access Token has expired is to check each API call for a 401 status in the response. In this case, call the Token endpoint to get a new a new short-lived Access Token without additional authentication and repeat the API call.
Keep Track Of Expiration Time To Live
A more involved method is to track the expiration TTL when you retrieve your Access Token. If the time has expired, call the Token endpoint to get a new a new short-lived Access Token without additional authentication and repeat the API call.