Authentication Overview

SmartOrder Open API uses the OAuth 2.0 client_credentials flow for server-to-server authentication. Each approved application receives a client_id and client_secret that identify the application when it accesses protected API resources.

How authentication works

1. Receive application credentials from SmartOrder.
2. Exchange the credentials for a short-lived access token through the Obtain an access token endpoint.
3. Send the token with each protected API request using the Authorization: Bearer <access_token> header.
4. Request a new token after the current token expires.

Application and hotel authorization

The access token identifies the calling application. SmartOrder resolves the application from the token's client_id and verifies that it is enabled and authorized for the hotelId in each request.

An invalid or expired token returns HTTP 401. An authenticated application without access to the requested hotel returns HTTP 403.

Token lifecycle

Access tokens have a default lifetime of 7,200 seconds (2 hours). Use the expires_in value returned by the token endpoint to cache a token until shortly before expiry instead of requesting a new token for every API call.

Security

Keep the client_secret and access tokens in a server-side secret manager. Do not expose them in browser code, source control, URLs, logs, screenshots, or support messages. Send credentials only over HTTPS and rotate them after suspected exposure.

Webhook callback tokens authenticate outbound Webhook delivery only and cannot be used as Open API Bearer credentials.