Authentication

Spot APIs require an Authentication header with a valid access token obtained via OpenID Connect (OIDC), specifically using the OIDC flow via client credentials.

To get started, you will need to first engage with our sales team, so we can configure policies for you to quote/enroll against. Our Sandbox environment may be used as a testing ground prior to going live in Production. Spot will provide you with three unique values per environment:

• Partner ID: include in all API requests via the X-Spot-Partner-Id header (not required for the initial token exchange, or for quote requests).
• Client ID: used in the OIDC flow.
• Client Secret: used in the OIDC flow.

Treat the client ID and secret as sensitive credentials. Store them securely (e.g., in environment variables, as secrets, etc) and never commit them to source code.

Spot provides an API endpoint that can be used to exchange your client ID and secret for a temporary access token. As an example, the following curl command can be used to issue a request to our sandbox API:

curl --request POST \
     --url https://api.sandbox.getspot.com/api/oauth/token \
     --header 'content-type: application/json' \
     --data '
{
  "client_id": "your_client_id_here",
  "client_secret": "your_client_secret_here"
}
'

If the given client_id and client_secret are valid, the response will look something like the following:

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "expires_in": 86400,
  "token_type": "Bearer"
}

Notice the token_type in the response is Bearer, and the expires_in field will indicate the number of seconds for which the token is valid. The access_token field contains the value that you will subsequently pass to our API endpoints in the Authorization header of your request.

You may now utilize this token to issue a request. For example, to accept a previously-generated quote by id, issue the following curl command:

curl --request GET \
     --url https://api.sandbox.getspot.com/api/v1/quote/<a_previously_generated_id_here>/accept \
     --header 'X-Spot-Partner-Id: <your_spot_provided_id>' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer <your_access_token_here>'