Generate an access token

Call this endpoint from your backend before making a protected developer API request. The route itself does not require a Bearer token, but it accepts only a valid client ID and matching client secret from a registered application.

Keep this server-side: Anyone who obtains both credential values can request a token as your application. Never proxy this request directly from a browser or mobile client.

Before making the request

1. Sign in to the Developer Console.
2. Create an application under Apps.
3. Copy the client ID and one-time client secret.
4. Store both values in a backend secret manager.

The client secret cannot be retrieved from Waspito after the creation response because only its SHA-256 hash is stored.

Request headers

Do not send an Authorization header to obtain the token.

Request body

Omit callback_url if you do not intend to update the application's configured callback destination.

cURL example

curl --request POST \
  'https://app.waspito.com/api/v1/icers-bridge/ehealth-access/oauth/token' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "callback_url": "https://api.example.com/waspito/callback"
  }'

JavaScript backend example

const response = await fetch(
  `${process.env.WASPITO_API_BASE_URL}/oauth/token`,
  {
    method: 'POST',
    headers: {
      Accept: 'application/json',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      client_id: process.env.WASPITO_CLIENT_ID,
      client_secret: process.env.WASPITO_CLIENT_SECRET
    })
  }
);

const payload = await response.json();

if (!response.ok || payload.status !== true) {
  throw new Error(payload.message || 'Unable to authenticate with Waspito');
}

const accessToken = payload.data.access_token;
const expiresInSeconds = payload.data.expires_at;

Successful response

The endpoint returns HTTP 200:

{
  "data": {
    "access_token": "YOUR_TEMPORARY_ACCESS_TOKEN",
    "token_type": "Bearer",
    "expires_at": 43200,
    "scopes": "generate-call-link,make-call"
  },
  "status": true,
  "message": "Access token generated with success.",
  "code": "_WT_201"
}

Production tokens are created with a 12-hour lifetime. Non-production environments currently use a 5-hour lifetime. Always rely on the returned duration rather than hard-coding either value.

Token lifecycle

• Waspito stores one developer access-token record per application.
• Requesting another token updates that record; use the newest returned token across your backend instances.
• Tokens stop working after expiry or revocation.
• There is no public refresh-token route in the current contract. Generate a new access token using the client credentials.
• Renew shortly before a protected request when the cached token is close to expiry; avoid generating a token for every API call.

Use the token

Authorization: Bearer YOUR_TEMPORARY_ACCESS_TOKEN

Never put the token in a query string. Query strings commonly enter browser history, proxy logs, and analytics systems.

Error responses

Invalid client credentials

HTTP 401:

{
  "data": [],
  "status": false,
  "message": "Invalid client credentials",
  "code": "_WT_UNAUTHORIZED"
}

Do not automatically retry the same credential pair. Repeated retries cannot fix a mismatched ID or secret.

Validation failure

HTTP 422 is returned when a required value is missing or callback_url is not a valid URL. Laravel validation responses include a field-level errors object; log only field names, never submitted secret values.

Safe renewal pattern

1. Read the cached token and its local expiry.
2. If it remains valid beyond your safety window, reuse it.
3. Otherwise, allow one backend worker to request a replacement.
4. Store the new token and expiry atomically in encrypted shared cache.
5. Retry a protected request once after a 401; if it still fails, surface an operational alert.

This prevents simultaneous workers from replacing each other's token and continuing with stale values.

Troubleshooting