If you are integrating via REST then we strongly recommend you authenticate using a JWT, as per this guide.

A special token that grants full and permanent API access to an account.

The recommended standard method for authentication, especially when integrating via REST.

The ability to interact with the service's Application Programming Interface (API).

Older integration setups that may not have the capability to use modern authentication methods like SDKs or the dynamic generation of a JWT.

is a standard, stateless architectural style that uses HTTP methods (like GET and POST) to manage web resources identified by unique URLs.

The Web Portal where PassKit users can manually navigate to the Pass API settings and generate a Long-Lived Token.

The specific API URL used to programmatically obtain a token by sending a POST request with a special header.

The required HTTP header used when consuming the REST API. The token must be included within this header.

The required text that must precede the Long-Lived Token within the Authorization Header for successful authentication.

There are two ways you can obtain a long-lived API token:

Open the project you want to the Long Lived Token for, click on settings on the top menu, then click on the Pass API's in the side menu.
​

Enter your account password, then click "Generate API Token"

Upon successful authentication, your token will be displayed. You can now copy this and store somewhere safe.
​

You can also obtain a token by calling the login endpoint with a special request header.

METHOD: POST

URL: https://api.pub1.passkit.io/login

HEADERS: x-passkit-longlived-token: true

BODY: { "username": "xxx", "password": "xxx" }
​

RESPONSE: { "token": "xxx" }

To use your token, include it in your authorisation header with a Bearer prefix to consume the REST API.