Autenticazione

E-CUBE usa OAuth 2.0 Resource Owner Password Credentials (password grant). La specifica ufficiale dichiara lo schema oauth2 con flusso password e tokenUrl: /Token.

Richiesta del token

POST <BASE_URL>/Token
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=<USERNAME>&password=<PASSWORD>

Campo	Valore
grant_type	password (costante)
username	Utente E-CUBE
password	Password dell'utente

Risposta

{
  "access_token": "<token>",
  "token_type": "bearer",
  "expires_in": <secondi>,
  "userName": "<USERNAME>",
  ".issued": "<data emissione>",
  ".expires": "<data scadenza>"
}

expires_in indica la durata del token in secondi.

Uso del token

Invia il token in ogni chiamata successiva:

Authorization: Bearer <ACCESS_TOKEN>

Senza token l'API risponde 401 con:

{"Message":"Authorization has been denied for this request."}

Esempi

curl

curl -X POST "<BASE_URL>/Token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=password" \
  --data-urlencode "username=<USERNAME>" \
  --data-urlencode "password=<PASSWORD>"

C#

using var http = new HttpClient { BaseAddress = new Uri("<BASE_URL>/") };
var form = new FormUrlEncodedContent(new Dictionary<string, string>
{
    ["grant_type"] = "password",
    ["username"] = Environment.GetEnvironmentVariable("ECUBE_USERNAME")!,
    ["password"] = Environment.GetEnvironmentVariable("ECUBE_PASSWORD")!,
});
using var resp = await http.PostAsync("Token", form);
resp.EnsureSuccessStatusCode();
using var doc = JsonDocument.Parse(await resp.Content.ReadAsStringAsync());
var token = doc.RootElement.GetProperty("access_token").GetString();
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

JavaScript

const resp = await fetch(`${process.env.ECUBE_BASE_URL}/Token`, {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "password",
    username: process.env.ECUBE_USERNAME,
    password: process.env.ECUBE_PASSWORD,
  }),
});
if (!resp.ok) throw new Error(`Token: HTTP ${resp.status}`);
const { access_token } = await resp.json();