Authentication

The OptoSoft Retapos API uses JSON Web Tokens (JWT). Log in once to receive a token, then send it as a Bearer token on every subsequent request.

1. Obtain a token

Send your OptoSoft credentials to the login endpoint. The request body follows the OMLoginRequest schema (userName, password).

POST /api/Auth/login

curl -X POST https://app.opto-soft.com/global/api-v1/api/Auth/login \
  -H "Content-Type: application/json" \
  -d '{
        "userName": "YOUR_USERNAME",
        "password": "YOUR_PASSWORD"
      }'

A successful response returns a signed JWT access token. Store it securely — treat it like a password.

2. Authorize your requests

Add an Authorization header with the Bearer scheme to every call. 

curl https://app.opto-soft.com/global/api-v1/api/Account/user-details \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"
Tokens are time-limited. When a request returns 401 Unauthorized, request a new token from the login endpoint and retry.

Security best practices

  • Always call the API over HTTPS. Never send credentials or tokens over plain HTTP.
  • Keep tokens on the server side. Do not embed credentials or tokens in browser or mobile client code.
  • Re-authenticate on 401 rather than caching a token indefinitely.
  • Scope credentials to the integration that needs them and rotate them if you suspect exposure.
Open API Reference Errors & Conventions
Chat with us
Call us