Authentication

Authentication

Every request needs an OAuth 2.0 access token, sent in the Authorization header:

curl "https://api.sandbox.theflowerfactory.ie/partner/v1/orders/WEB-100234" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Your credentials

When we set you up, we give you a client ID and a client secret. They identify your application and the account your orders belong to: you only ever see your own orders.

Getting a token

Get a token from Microsoft Entra ID with the client credentials flow:

curl -X POST "https://login.microsoftonline.com/b66ad013-3458-4610-a433-7bdd1264b5b4/oauth2/v2.0/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=api://24579c38-caed-4940-a35f-8fc7763b718c/.default"

The response has the token in access_token, and how many seconds it lasts in expires_in (about an hour). Reuse the token until it’s close to expiring, then get a new one: don’t get a new token for every request.

Most OAuth 2.0 libraries handle this for you. In .NET, for example, use MSAL’s ConfidentialClientApplicationBuilder (Microsoft.Identity.Client) with the same tenant and scope: it caches the token and gets a new one when it expires.

When a request is refused

• 401 Unauthorized: the token is missing, invalid or expired. Get a new token and try again.
• 403 Forbidden: the token is valid, but not for an application we’ve set up as a partner. Check you’re using the credentials we gave you for this environment.