Authentication

The APIs use two layers of authentication: mutual TLS on the connection and a bearer token on each request.

Mutual TLS

Mutual TLS requires both the client and the server to prove their identity with a certificate before an encrypted connection is established. Gowd issues a client certificate (PFX) for each partner and environment during onboarding.

If you use Postman, see the Postman guide on client certificates.

Example request using the certificate:

import axios from "axios";
import https from "https";
import fs from "fs";

const serverURL = "https://mtls-api-platform-hml.gowd.com";
const pfxPath = "/path/to/client.pfx"; // Path to your PFX file

const agent = new https.Agent({
  pfx: fs.readFileSync(pfxPath),
  passphrase: "your_pfx_file_password", // Password for your PFX file
});

const requestData = {
  // Your request payload here
};

axios
  .post(serverURL, requestData, { httpsAgent: agent })
  .then((response) => {
    console.log("Response:", response.data);
  })
  .catch((error) => {
    console.error("Request error:", error.message);
  });

Bearer token

With the mTLS connection in place, generate an access token on the /auth/v1/token endpoint using your client credentials and send it on every request in the Authorization header with the Bearer prefix:

Authorization: Bearer <access_token>

See the API Reference for the token endpoint contract.