Authentication

The OptoSoft Developers API uses JSON Web Tokens (JWT). Log in once to receive a token, then send it as a Bearer token on every subsequent request.

1. Obtain a token

Send your OptoSoft credentials to the login endpoint. The request body follows the OMLoginRequest schema (userName, password).

POST /api/Auth/login

curl -X POST https://app.opto-soft.com/global/api-v1/api/Auth/login \
  -H "Content-Type: application/json" \
  -d '{
        "userName": "YOUR_USERNAME",
        "password": "YOUR_PASSWORD"
      }'

A successful response returns a signed JWT access token. Store it securely — treat it like a password.

2. Authorize your requests

Add an Authorization header with the Bearer scheme to every call. 

curl https://app.opto-soft.com/global/api-v1/api/Account/user-details \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"
Tokens are time-limited. When a request returns 401 Unauthorized, request a new token from the login endpoint and retry.

Security best practices

  • Always call the API over HTTPS. Never send credentials or tokens over plain HTTP.
  • Keep tokens on the server side. Do not embed credentials or tokens in browser or mobile client code.
  • Re-authenticate on 401 rather than caching a token indefinitely.
  • Scope credentials to the integration that needs them and rotate them if you suspect exposure.

Testing with Postman

The OptoSoft Postman collection handles this flow for you: fill in the userName and password collection variables, send POST /api/Auth/login, and its test script stores the returned JWT in the accessToken variable. Every other request in the collection inherits that token as its Bearer credential.

Open API Reference Postman collection Errors & Conventions
Chat with us
Call us