Authentication

The Modaltrans API requires JWT Bearer tokens for authentication, which are obtained by logging in with the email and password of your API user. If the credentials are incorrect, the API will return a '403 Forbidden' error. Tokens are valid for 24 hours, after which a new token must be generated.

Please use the "Get Bearer Token" method under the "Get Auth Token" collection.

Send the token in the Authorization header of every request:

Security Considerations

When interacting with the Modaltrans API using JWT Bearer tokens, it's important to follow these security best practices to protect your application and data:

Securely Store the JWT Token
Once you receive a JWT Bearer token from the Modaltrans API, ensure it is stored securely. Do not store the token in places accessible to JavaScript, such as local storage or session storage.

Token Expiry and Renewal
JWT tokens provided by the Modaltrans API are valid for 24 hours. There is no refresh endpoint: when a token expires, log in again with the "Get Bearer Token" method to get a new one. Requesting a new token shortly before the current one expires ensures continuous access to the API.

Do Not Share Your JWT Token
Treat your JWT token like a password. Do not share it publicly or hard-code it in client-side code, as this could allow unauthorized access to your API.

By following these security considerations, you can help ensure that JWTs are used safely and effectively within your applications.

Authentication error response

When interacting with the Modaltrans API, authentication is a crucial step. If the API cannot authenticate you, you will receive an HTTP 403 Forbidden response. This applies both to the login request and to any other request sent with a missing, invalid, or expired token.

Possible Causes of HTTP 403 Response When Logging In:

Incorrect Credentials: The email or password provided is incorrect, or the account is not an API user.

Account Disabled: The user account or your company's Modaltrans account is not active.

IP Restriction: Your API user is restricted to specific IP addresses and the request comes from a different one.

Possible Causes of HTTP 403 Response on Other Requests:

Missing Token: The Authorization header is not included in the request.

Invalid Token: The token is malformed or has expired.

Example of an Authentication Error Response

When an authentication error occurs, the API response will include details about the failure. Below are examples of typical error responses:

Invalid login credentials

{
  "error": {
    "user_authentication": [
      "Invalid login credentials"
    ]
  }
}

Missing, invalid, or expired token

{
  "error": "Invalid Authorization Token"
}

How to Handle Authentication Errors:

Verify Credentials: Double-check that the email and password being sent are correct and formatted properly. Ensure that any required fields are not missing.

Check Token Validity: Ensure that the token is sent as Bearer <your_token> in the Authorization header and that it is not expired. If it has expired, log in again to get a new token.

If you need help or have any questions, please Contact our support team.

Authentication

Security Considerations#

Authentication error response#

Possible Causes of HTTP 403 Response When Logging In:#

Possible Causes of HTTP 403 Response on Other Requests:#