- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Authorizing Requests
Except for a few public endpoints, every request to the CertSecure Manager API must be authenticated with an API token. The token is sent as a bearer token in the Authorization header of each request.
Generating an API Token
API tokens are generated in the CertSecure Manager portal:
- Go to Utilities, then API Tokens.
- Click Generate Token and provide a token name, the validity period in days, and, optionally, the trusted IP addresses that may use the token and notes.
- Choose whether the token can be refreshed. Tokens with Token Refresh set to true can be renewed; tokens with Token Refresh set to false are one-time tokens that expire at the end of their validity period.
- Copy the generated token and store it securely.
Generating and managing tokens requires the Manage API Tokens permission. For details, refer to Utilities > API Tokens. Tokens can also be managed through the API Token Management endpoints.
Sending the Token
Pass the token in the Authorization header using the Bearer scheme:
Authorization: Bearer <token>curl
curl -X GET "https://<certsecure-backend-url>/check_token" \
-H "Authorization: Bearer <token>"PowerShell
$headers = @{ Authorization = "Bearer <token>" }
Invoke-RestMethod -Method Get -Uri "https://<certsecure-backend-url>/check_token" -Headers $headersPython
import requests
headers = {"Authorization": "Bearer <token>"}
response = requests.get("https://<certsecure-backend-url>/check_token", headers=headers)
print(response.status_code, response.text)A valid token returns 200 with the body True.
Authorizing in the Swagger API
-
Open the Swagger API page at
https://<certsecure-backend-url>/api/docs/. - Click Authorize.
-
In the value box, enter
Bearer <token>and click Authorize. - Close the dialog. Requests sent with Try it out now include the token.
Public Endpoints
The following endpoints do not require a token:
| Endpoint | Description |
|---|---|
| GET /check | Reachability check of the backend. |
| GET /version | Backend and frontend versions. |
| GET /v2/acme | ACMEv2 directory used by ACME clients. |
Authentication Errors
When a token is missing or cannot be used, the API returns 401
Unauthorized with one of the following messages:
| Response Body | Meaning |
|---|---|
{"message": "Token is missing!"} |
The Authorization header was not sent. |
{"message": "Token is invalid!"} |
The header is malformed, for example the Bearer prefix is missing, or the token is not recognized. |
{"message": "Token has expired"} |
The validity period of the token has ended. Refresh the token or generate a new one. |
{"message": "Token is inactive"} |
The token has been revoked. |
{"error": "Invalid or expired session"} |
The token could not be validated. Generate a new token and try again. |
A valid token that lacks the permission for an operation returns 403
Forbidden.