Skip to navigation
Using the API

Authentication

Eon API methods are secured and require an access token for every request. Without a valid access token, your API calls fail. This ensures that only authorized actors can interact with your resources.

Authenticate API calls

Before you start

  • Before you can authenticate, you need to create API credentials—meaning, API client ID and secret—in the Eon console. API credentials allow you or external apps to interact with the Eon API without sharing your login details.

    Your client secret is displayed only when you create or rotate your API credentials. It can’t be retrieved later.

    Make sure to store your client secret securely. If you lose your secret or it becomes compromised, you’ll need to create a fresh set of API credentials and update your client ID and secret everywhere they’re used.

  • Make sure there’s a role that has the exact permissions you want to grant to the credentials. If there isn’t one, you can create a custom role.

1

Get an access token

Use the client ID and secret to authenticate with the Eon API and get an access token.

Example request: Get an access token
curl -L 'https://{your_eon_subdomain}/api/v1/token' \
-H 'Accept: application/json' \
-d '{
  "clientId": "yaeiq7...6xwyxa7k2a",
  "clientSecret": "eon_98acb36d8e029e...b815131d935055e8af761ff5d1534605486b588"
}'
Response
{
  "accessToken": "eyJraWQiOiJFOD...0y07s8upSDwyJX6TE8JZ73oX4rOpnjaOQ",
  "expirationSeconds": 43200
}
2

Call an API method with your access token

Call any API method, making sure you provide the access token in the Authorization header.

Example request: Get daily storage summaries
curl -L 'https://{your_eon_subdomain}/api/v1/projects/:projectId/dashboard/daily-storage-summary' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer eyJraWQiOiJFOD...0y07s8upSDwyJX6TE8JZ73oX4rOpnjaOQ'
3

Generate new access tokens

Access tokens are valid for 12 hours, so you’ll need to generate new ones regularly. You can do this by calling Get Access Token with your client ID and secret, and then providing the new token to subsequent API calls.

Key points to remember

  • Secure your credentials
    Keep your client ID, client secret, and access tokens confidential. Don’t share them in publicly accessible locations, such as GitHub repositories or client-side code.

  • HTTPS required
    All Eon API requests must be made over HTTPS. If a request is sent over plain HTTP, it fails.

  • Refresh your access tokens
    Access tokens expire after 12 hours. Plan to generate new tokens periodically to avoid interruptions in your workflows.

  • Rotate secrets periodically
    As a security best practice, you can proactively rotate your client secrets on a regular basis. Use Rotate API Client Secret or Rotate Current API Client Secret to generate a new secret while keeping the same client ID.

Was this page helpful?