Authentication

Every REST API request carries an OAuth 2.0 bearer token. You obtain the token once with the client credentials grant, using the ID and secret of an API client, and then send it in the Authorization header of every request that follows. Traffic between your client and Live Hub is secured with TLS.

Create the API client first, in Access control (IAM). See API clients. The client secret is shown only while you are creating the client, so copy it then.

The dialout endpoint, /api/v1/actions/dialout, is the one exception. It uses HTTP Basic authentication with the client ID and secret directly, with no token to obtain first. See Dialout API.

Get a token

To obtain a token, send the client ID and secret as form data in a POST request to https://livehub.audiocodes.io/oauth/token:

POST /oauth/token HTTP/1.1
Host: livehub.audiocodes.io
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}

The response carries the token and its remaining lifetime in seconds:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 3600
}

An access token is valid for one hour. Reuse it across requests until it expires rather than fetching a new one per request.

Use the token

Send the token in the Authorization header of every request:

Authorization: Bearer {token}

A request with a missing, invalid, or expired token is rejected with 401 Unauthorized.