Skip to main content

Authentication

The gRPC API uses the OAuth 2.0 client credentials flow. Your service swaps its client ID and secret for an access token, then sends the token with every API call.

1. Get a token​

curl --request POST \
  --url https://auth.transit-technologies.ai/oauth/token \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET

The response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "expires_at": 1767225600
}
  • expires_in is the token lifetime in seconds.
  • expires_at is when the token expires, as a Unix timestamp in seconds.

A failed request returns 401 with {"error": "invalid_client"} when the ID or secret is wrong.

2. Call the API​

Send the token in the authorization metadata of each gRPC call:

authorization: Bearer eyJhbGciOiJSUzI1NiIs...

3. Renew the token​

Re-use one token until it is close to expires_at, then get a new one. Do not request a new token for every call.

Keep the secret secret

The client secret gives access to your fleet's data. Keep it in a secret store, never in source control or in a browser or mobile app. If it leaks, contact us and we will rotate it.