Skip to content
Partner Developer Center

Authentication

Auto Equity API uses bearer tokens. Your backend exchanges the consumer_key and consumer_secret issued by Creditas for an access_token, then sends that token with every request.

Generate an access token

Section titled “Generate an access token”

Select the authentication endpoint for your environment and send a POST request:

Terminal window
export CREDITAS_AUTH_URL="https://auth-staging.creditas.com.br/api/affiliate_clients/tokens"
export CREDITAS_CONSUMER_KEY="<consumer-key>"
export CREDITAS_CONSUMER_SECRET="<consumer-secret>"


curl --fail-with-body --silent --show-error \
  --request POST "$CREDITAS_AUTH_URL" \
  --header "Accept: application/json" \
  --header "Accept-Version: v1" \
  --header "Content-Type: application/json" \
  --data "{
    \"consumer_key\": \"$CREDITAS_CONSUMER_KEY\",
    \"consumer_secret\": \"$CREDITAS_CONSUMER_SECRET\"
  }"

The response includes the token and its validity in seconds:

{
  "access_token": "<access-token>",
  "token_type": "bearer",
  "expires_in": 7200
}

Do not rely on the example expires_in value. Read the value returned by each response and generate a new token before it expires.

Use the token

Section titled “Use the token”

Send the token in the Authorization header of every Auto Equity operation:

Terminal window
curl --fail-with-body --silent --show-error \
  "https://stg-api.creditas.io/mx/b2b/autoequity/api/leads/<lead-id>" \
  --header "Authorization: Bearer <access-token>" \
  --header "Content-Type: application/json"

A 401 Unauthorized response can mean the token is missing, expired, invalid, or belongs to another environment.

After authenticating, review the flow and statuses.