Authentication

authentication all litmus apis use oauth2 client credentials you exchange a client id and client secret for a short lived bearer token, then send that token on every subsequent api call litmus edge token endpoint post {{edgeurl}}/auth/v3/oauth/token important use /auth/v3/oauth/token the keycloak admin url ( /auth/realms/ ) you may see in the edge admin ui is not the api token endpoint request curl x post "https //\<edge host>/auth/v3/oauth/token" \\ h "content type application/x www form urlencoded" \\ d "grant type=client credentials" \\ d "client id=\<your client id>" \\ d "client secret=\<your client secret>" response { "access token" "eyjhbgcioi ", "token type" "bearer", "expires in" 3600 } using the token curl "https //\<edge host>/devicehub/version" \\ h "authorization bearer eyjhbgcioi " litmus edge manager (lem) lem uses a long lived admin api token rather than oauth2 exchange generate one from the lem admin console two headers are used depending on the endpoint prefix endpoint prefix header /api/v1/ x authtoken \<token> /admin/v1/ x authtoken \<token> /mpcs/ authorization \<token> (no bearer ) sending the wrong header returns 401 the /mpcs/ marketplace endpoints use a plain authorization header value, the other prefixes use x authtoken see lem base urls # litmus uns uns uses oauth2 password grant against its bundled keycloak post {{uns url}}/auth/realms/standalone/protocol/openid connect/token body (form encoded) grant type=password , client id , username , password the returned access token is sent as authorization bearer \<token> on every /mqtt/gql graphql call token lifetime and refresh le tokens default to 1 hour ( expires in 3600 ) re fetch before expiry lem admin tokens are long lived; rotate via the admin console uns tokens follow the keycloak realm policy (typically 15 60 minutes) where to get credentials product where litmus edge system > settings > users > api clients lem admin console > api tokens luns admin > users (use the configured keycloak user)