Skip to main content

Security

Every request to the Bidlogix API must include a valid API token. Tokens are generated in the Bidlogix Admin by your own administrators. You no longer need to ask us for an API key, secret or signature.

Before You Start​

You need a plan that includes API access. Your Admin user also needs permission to view and generate API tokens. This is not turned on by default: email support@bidlogix.com and tell us which Admin user needs it.

Generating a Token​

  1. In the Bidlogix Admin, go to Integrations › API Tokens.
  2. Enter a name for the token, for example the name of the integration that will use it.
  3. Click Generate new API token.
  4. Copy the token and store it somewhere safe, such as a secrets manager.
The token is shown only once

After you leave the page you will only see the last four characters of the token. If you lose it, generate a new one.

Full steps are in our help article How to generate API access tokens.

Sending Your Token​

Send the token as the value of the BDXAPI_NAME header on every request. Send the token exactly as it was shown to you, with no prefix such as Bearer.

curl "https://your_bidlogix_domain/auction-mgt/bdxapi/auctioneers?clientId=your_bidlogix_client_id" \
  -H "BDXAPI_NAME: YOUR_API_TOKEN"

The token identifies your web app. If you also send the clientId query string parameter, it must be the web app the token belongs to.

Keep your token on your server

Call the API from your server only. Never put your token in browser JavaScript, cookies, mobile apps or public code repositories. Anyone who has the token can call the API as you.

Managing Tokens​

Each token is listed under Integrations › API Tokens with its name, when it was created, when it expires and when it was last used. From there you can:

  • Rename a token.
  • Disable a token to stop it working straight away, and Enable it again later.
  • Revoke a token to remove it permanently. You can revoke it immediately, or schedule it to stop working in 14 days so you have time to switch your integration over.

You can hold more than one live token. We recommend a separate token for each integration, so you can replace or revoke one without affecting the others.

Tokens belong to the Bidlogix environment they were generated in. A token generated on a staging site does not work on production.

Expiry and Rotation​

Tokens expire one year after they are generated.

On the Integrations › API Tokens page, enter the email addresses that should be told about expiring tokens in Token expiry emails. We email them 30, 14 and 1 days before each live token expires. If no address is entered, no reminder is sent.

To replace a token without any downtime:

  1. Generate a new token.
  2. Update your integration to send the new token.
  3. Check the old token's Last used date has stopped changing.
  4. Revoke the old token.

Moving from API Signatures​

We no longer issue API keys, secrets or signatures.

If your integration already sends a signature generated from an API key and secret, it carries on working for now. We have turned each existing signature into a token. It appears on your Integrations › API Tokens page with the name Legacy signature, and expires one year after it was converted, like any other token. You will get the same expiry reminders.

Before then, generate a new token, update your integration to send it, and revoke the legacy signature.

Troubleshooting​

A request with a missing, incorrect, expired, disabled or revoked token is refused with 401 Unauthorized:

{"failed":true,"field":null,"code":"401","message":"Access Denied","loggedIn":false}

If this happens, check that:

  • the header is named BDXAPI_NAME and holds the full token with nothing before it;
  • the token is listed as Active on your Integrations › API Tokens page and has not expired;
  • the token was generated on the same environment you are calling, for example production and not staging;
  • if you send clientId, it matches the web app the token belongs to.