Authentication

Every protected route requires a Bearer JWT in the Authorization header:

Authorization: Bearer <token>

If the header is missing or invalid you get 401 Unauthorized.

Get your client credentials

Create a V2 API client in the Aware dashboard, then exchange clientId / clientSecret for a JWT.

Open your company in the Aware dashboard and go to Settings → APIs & Integrations → API Clients.
Click Add V2 API Client (Beta). If the button is not visible, contact Rapid to enable it.
Enter a name (optional description) and create.
Copy the client id and client secret. Store the secret in your secret manager.

If the secret is lost, Edit → Rotate secret. The previous secret stops working immediately.

Then use the example below to get the token.

Example request

curl -sS -X POST "https://aware-api.invalid/api/auth/token" \
  -H "Content-Type: application/json" \
  -d '{"clientId":"YOUR_CLIENT_ID","clientSecret":"YOUR_CLIENT_SECRET"}'

const res = await fetch(`https://aware-api.invalid/api/auth/token`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    clientId: process.env.AWARE_CLIENT_ID,
    clientSecret: process.env.AWARE_CLIENT_SECRET,
  }),
})

if (!res.ok) {
  const error = await res.json()
  throw new Error(`${error.type}: ${error.message}`)
}

const { accessToken, expiresIn } = await res.json()
console.log({ accessToken, expiresIn })

import os
import requests

res = requests.post(
    "https://aware-api.invalid/api/auth/token",
    json={
        "clientId": os.environ["AWARE_CLIENT_ID"],
        "clientSecret": os.environ["AWARE_CLIENT_SECRET"],
    },
    timeout=30,
)
res.raise_for_status()
data = res.json()
print(data["accessToken"], data["expiresIn"])

Response

{
"accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIs...",
"tokenType": "Bearer",
"expiresIn": 86400
}

Use the token

In the API Reference, open Authorize and paste the token value. From code, send Authorization: Bearer <accessToken> on every /api/v1/* request.