Credentials and Tokens

You need an API Token from Key Management to send API requests through the ThingSpace platform. You must register at the ThingSpace portal and sign in to be able to get keys and generate tokens to work with the APIs. You only need to register once. Please be aware: There is a limit imposed for the number of API requests that can be sent in a period of time. Any IP address sending a request is only allowed to send 30 requests per second per API endpoint.

Obtaining an access_token

We use the OAuth2 “client credentials” grant type to authenticate an API caller before providing an access_token. We require that the application key and secret are Base64 encoded. To obtain an access_token:

Sign in and Sign up at the ThingSpace Portal
Click on your login icon (in the upper right corner) and from the drop-down select "Key Management". Below are the direct links to the Key Management page
Copy the key and the secret and store them in a secure place for your application to use.
Concatenate the key and the secret, with a colon between them, like this: my_key_value:my_secret_value
Encode the entire string in Base64 format. (To learn more about encoding in Base64 format, visit https://www.base64encode.org).
Get a token by sending a POST request to thingspace.verizon.com/api/ts/v1/oauth2/token as shown in the example below.

For help on How to Obtain Tokens please click here

cURL Example

curl --location --request POST 'https://thingspace.verizon.com/api/ts/v1/oauth2/token' \--header 'Authorization: Basic BASE64_ENCODED_APP_KEY_AND_SECRET' \--header 'Content-Type: application/x-www-form-urlencoded' \--data-urlencode 'grant_type=client_credentials'

The response will contain an access_token property that you must include as the authorization bearer token in the header of all API requests. The token will be valid for one hour from when it was first issued and any further token requests during that time will return the same token.

This API requires a special set of credentials that are associated with one or more Verizon business accounts and allow you to manage M2M and IoT devices through an API. These credentials are sometimes called “UWS credentials” or a “UWS account.”

If you don’t have a Verizon Business or Marketplace Account, you can request a trial account when you are ready to test with active devices on the Verizon Wireless network.
If your company is an existing Verizon Enterprise Customer, you can contact your sales team to request UWS credentials.

Obtaining a VZ-M2M sessionToken Programmatically

To send API requests, you must use your UWS credentials to authenticate with the POST https://thingspace.verizon.com/api/m2m/v1/session/login endpoint at the beginning of each API session. You must put the VZ-M2M sessionToken from the response in the header of all other API requests. To obtain a VZ-M2M sessionToken:

Follow the instructions above to get a ThingSpace token.
Send a POST /api/m2m/v1/session/login request with the ThingSpace token in the header and your UWS username and password in the body.

Example:

curl --request POST 'https://thingspace.verizon.com/api/m2m/v1/session/login' \  --header 'Content-Type: application/json' \  --header 'Authorization: Bearer <access_token from step 1:' \  --data-raw '{"username": "username here", "password": "credentials"}'

The response will contain a sessionToken, which you can use for the VZ-M2M-Token value in the header of all subsequent requests. The token will remain valid as long as your application continues to use it, but it will expire after 20 minutes of inactivity.

Note: All API calls after the session/login request must have both the ThingSpace access_token and the sessionToken in the header.

# Credentials and Tokens You need an API Token from Key Management to send API requests through the ThingSpace platform. You must register at the [ThingSpace portal](https://thingspace.verizon.com/profile/sign-up.html) and sign in to be able to get keys and generate tokens to work with the APIs. You only need to register once. **Please be aware**: There is a limit imposed for the number of API requests that can be sent in a period of time. Any IP address sending a request is only allowed to send 30 requests per second per API endpoint. ## Obtaining an access_token We use the OAuth2 “client credentials” grant type to authenticate an API caller before providing an access_token. We require that the application key and secret are Base64 encoded. To obtain an access_token: 1. Sign in and Sign up at the [ThingSpace Portal](https://thingspace.verizon.com/profile/sign-up.html) 2. Click on your login icon (in the upper right corner) and from the drop-down select "Key Management". Below are the direct links to the [Key Management page](https://thingspace.verizon.com/profile/key-management.html) 3. Copy the key and the secret and store them in a secure place for your application to use. 4. Concatenate the `key` and the `secret`, with a colon between them, like this: `my_key_value:my_secret_value` 5. Encode the entire string in Base64 format. (To learn more about encoding in Base64 format, visit [https://www.base64encode.org](https://www.base64encode.org)). 6. Get a token by sending a POST request to `thingspace.verizon.com/api/ts/v1/oauth2/token` as shown in the example below. _For help on How to Obtain Tokens please_ **_[click here](/docs/guided-walkthroughs/gettokens)_** ## cURL Example ```bash curl --location --request POST 'https://thingspace.verizon.com/api/ts/v1/oauth2/token' \ --header 'Authorization: Basic BASE64_ENCODED_APP_KEY_AND_SECRET' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' ``` The response will contain an `access_token` property that you must include as the authorization bearer token in the header of all API requests. **_The token will be valid for one hour from when it was first issued_** and any further token requests during that time will return the same token. ## Unified Web Services (UWS) Login credentials (VZ-M2M token) This API requires a special set of credentials that are associated with one or more Verizon business accounts and allow you to manage M2M and IoT devices through an API. These credentials are sometimes called “UWS credentials” or a “UWS account.” - If you don’t have a Verizon Business or Marketplace Account, you can request a trial account when you are ready to test with active devices on the Verizon Wireless network. - If your company is an existing Verizon Enterprise Customer, you can contact your sales team to request UWS credentials. ## Obtaining a VZ-M2M sessionToken Programmatically To send API requests, you must use your UWS credentials to authenticate with the `POST` [https://thingspace.verizon.com/api/m2m/v1/session/login](https://thingspace.verizon.com/api/m2m/v1/session/login) endpoint at the beginning of each API session. You must put the VZ-M2M sessionToken from the response in the header of all other API requests. To obtain a VZ-M2M sessionToken: 1. Follow the instructions above to get a ThingSpace token. 2. Send a `POST /api/m2m/v1/session/login` request with the ThingSpace token in the header and your UWS username and password in the body. Example: ```bash curl --request POST 'https://thingspace.verizon.com/api/m2m/v1/session/login' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer <access_token from step 1:' \ --data-raw '{"username": "username here", "password": "credentials"}' ``` The response will contain a `sessionToken`, which you can use for the `VZ-M2M-Token` value in the header of all subsequent requests. **_The token will remain valid as long as your application continues to use it, but it will expire after 20 minutes of inactivity._** **Note**: All API calls after the session/login request must have both the ThingSpace `access_token` and the `sessionToken` in the header.