Quickstart - Simply Tokenized API

This guide walks through obtaining an access token and listing offerings on the development environment.

Prerequisites

An active API credential (client_id and client_secret) from the Asset Manager dashboard (dev tenant)
At least the offering.read scope enabled on your credential
Beta version 2026-07-02 is available on development: https://dev.api.floris3.com/api

Step 1 — Authenticate

Request a bearer access token:

curl -X POST "https://dev.api.floris3.com/api/auth" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "scopes": ["offering.read"],
    "api_version": "2026-07-02"
  }'

const response = await fetch("https://dev.api.floris3.com/api/auth", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: process.env.CLIENT_ID,
    client_secret: process.env.CLIENT_SECRET,
    scopes: ["offering.read"],
    api_version: "2026-07-02",
  }),
});

const { access_token, expires_at } = await response.json();
console.log("Token expires at:", expires_at);

import os
import requests

response = requests.post(
    "https://dev.api.floris3.com/api/auth",
    json={
        "client_id": os.environ["CLIENT_ID"],
        "client_secret": os.environ["CLIENT_SECRET"],
        "scopes": ["offering.read"],
        "api_version": "2026-07-02",
    },
)
response.raise_for_status()
data = response.json()
access_token = data["access_token"]

Example response:

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_at": "2026-07-12T10:40:00.000Z"
}

The response includes:

ST-Api-Version: 2026-07-02
ST-Api-Version-Beta: true

Version 2026-07-02 is in beta and available on development. See Versioning.

Step 2 — Call a protected endpoint

Use the access token to list offerings:

curl "https://dev.api.floris3.com/api/offerings?limit=10&offset=0&lang=en" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Other environments

Environment	Base URL
Staging	`-`
Live	`-`

Use environment-specific credentials for each environment. Beta API versions are available on development; live receives stable versions when they are released. Configure an outbound webhook URL in Administration → API Access → Webhooks to receive order.created and order.status_updated events. See Webhook overview.

Token lifetime

Access tokens expire after 10 minutes (600 seconds). Request a new token before expires_at.

Troubleshooting

Status	Cause
`401`	Invalid `client_id` or `client_secret`
`403`	Requested scope not allowed for this credential
`429`	Auth or API rate limit exceeded

See Errors for the full error reference.

​Prerequisites

​Step 1 — Authenticate

​Step 2 — Call a protected endpoint

​Other environments

​Step 3 — Subscribe to webhooks (optional)

​Token lifetime

​Troubleshooting