Authentication

The API uses short-lived bearer tokens. Swap your client ID and secret for a token, then send the token on every call.

Get a token

POST /authorize

Send the ID and secret as JSON:

curl -X POST https://api.routetracks.com/api/v1/partner/v1/authorize \
  -H "Content-Type: application/json" \
  -d '{"clientId":"fn_live_id_XXXX","clientSecret":"fn_live_sk_XXXX"}'

Field	Required	Description
clientId	yes	Your client ID. username is accepted as an alias.
clientSecret	yes	Your client secret. password is accepted as an alias.
grantType	no	If sent, must be client_credentials.

Response 201

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
  "tokenType": "Bearer",
  "expiresIn": 3600,
  "expiresAt": "2026-10-23T13:00:00.000Z"
}

A token is valid for one hour (expiresIn is in seconds).

Use the token

Send it in the Authorization header:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…

Refreshing

There is no refresh token. Call /authorize again when either of these happens:

• expiresAt is near: renew a minute or two before it.
• A call returns 401 with code PARTNER_TOKEN_EXPIRED.

Cache the token and reuse it for its whole hour. Requesting a new token for every call quickly hits the /authorize rate limit.

Errors from /authorize

Status	Code	Meaning
400	PARTNER_INVALID_GRANT	ID or secret missing.
401	PARTNER_UNAUTHORIZED	Wrong ID or secret, client revoked, scopes not usable, or calling from an IP address that isn't allowed.
429	PARTNER_RATE_LIMITED	Too many token requests. Wait for the Retry-After seconds.

For security, every credential problem returns the same 401 message.

Revoking access

When an administrator revokes a client in Settings → Partner API, its secret stops working and its existing tokens are rejected. Changing a client's scopes also rejects tokens already issued. Call /authorize again after a scope change.

The allowlist, when set, is checked on /authorize and again on every call made with the token. A call from an address that isn't allowed gets 401 with code PARTNER_UNAUTHORIZED, even with a valid token.