Authentication

Get a token first. No other call works without one. See Create an access token.

curl -X POST https://staging-api.allout.ae/api/v1/partner/auth/token \
  -H "Content-Type: application/json" \
  -d '{"clientId":"YOUR_CLIENT_ID","clientSecret":"YOUR_CLIENT_SECRET"}'

Send Authorization: Bearer <accessToken> on every other call.

• A token is valid for one hour. Ask for a new one before it ends, and on any 401.
• Keep the client secret on your server, never inside a mobile or web app.
• Limits: 10 token requests a minute and 120 requests a minute on other routes.
• Never put real credentials in this documentation.