Authentication

The API4ALL v3 API uses token-based authentication. There are two steps:

1. Generate an access token using your credentials and project code.
2. Refresh the token when it expires.

Every API request (other than the token endpoints themselves) must include a Bearer access token.

Your credentials

You receive these during onboarding:

Step 1: Generate an access token

Send your username and password as HTTP Basic authentication (Base64-encoded as username:password).

GET /a4a/3.0/api/token/{project_code}
Authorization: Basic {Base64(username:password)}

Example

GET https://sandbox-v3.api4all.io/a4a/3.0/api/token/YOUR_PROJECT_CODE

Response

{
  "access_token": "d930c7e-773-ad5-a89-0e9634fa",
  "client_id": "c9518c-666-4699-83e-1730143",
  "client_secret": "0df24-8ec-4e498f3-a5c5d5390",
  "expires_in": 7200,
  "refresh_token": "aa63-0f1-460-b94-8a4bd71",
  "scope": "all",
  "company": "Infocredit Group",
  "token_type": "bearer",
  "username": "admin"
}

Keep the access_token , refresh_token , client_id and the client_secret you will need all of them.

Step 2: Use the access token

Include it in the Authorization header of every subsequent request, as a Bearer token.

Authorization: Bearer {access_token}

Example

GET https://sandbox-v3.api4all.io/a4a/3.0/api/report/kyb/code/CY00001234406861
Authorization: Bearer d930c7e-773-ad5-a89-0e9634fa

Step 3: Refresh the token

When the access token expires, exchange your refresh token for a new one. This request sends your credentials in the body, no Authorization header.

POST /a4a/3.0/api/refresh/
Content-Type: application/json

Request

{
  "refresh_token": "acf63-0f91-601-9e4-8fb4701",
  "client_id": "c548c-666-499-813e-17330e3",
  "client_secret": "d524-8ec-43e4-f3-a55d350"
}

Response

{
  "access_token": "40h7m4-557-442-s56-a0747g0wh",
  "expires_in": 7200,
  "refresh_token": "5t2w8-732-148-q07-o08scs8",
  "token_type": "bearer"
}

The response returns a new refresh token as well. Store it and use it for the next refresh.

Token expiry

Response codes

A 400 on refresh means a required field (refresh_token, client_id, or client_secret) is missing. A 401 means the refresh token is invalid or expired. Generate a fresh token via Step 1 instead. A 405 means the wrong HTTP method was used (Refresh Token requires POST, Create Token requires GET).