Authentication

M2M Auth

To whitelist your domain and avoid CORS issues, follow the steps in Configuring Allowed Domains (CORS)

Expiry time of the token is 30 minutes from the time a fresh token is generated.

Generate a token for an M2M client

post

Authenticates a machine-to-machine client using Basic Authentication and returns an access token. The Basic Auth value should be constructed as: Base64(clientId:clientSecret)

No request body is required. Credentials are passed only in the Authorization header.

Authorizations

AuthorizationstringRequired

Header parameters

AuthorizationstringRequired

Basic authentication header. Format: "Basic " + Base64(clientId:clientSecret)

Example: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Responses

200

Token generated successfully

application/json

tokenstringRequired

JWT token for authentication

Example: eyJhbGciOiJIUzI1NiIsInR5cC.......

expiresOnstring · date-timeRequired

Token expiration timestamp in ISO 8601 format

Example: 2024-10-22T18:40:54.908Z

400

Bad request

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

post/m2m/token

POST /v1/m2m/token HTTP/1.1
Host: api.multiset.ai
Authorization: text
Accept: */*

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cC.......",
  "expiresOn": "2024-10-22T18:40:54.908Z"
}

Credentials are passed only in the Authorization header as Basic Base64(clientId:clientSecret). No request body is required.

Code Examples

Browser (JavaScript)

For client-side applications like WebXR, you can generate tokens directly in the browser:

async function generateToken(clientId, clientSecret) {
  const authorization = "Basic " + btoa(`${clientId}:${clientSecret}`);

  const response = await fetch("https://api.multiset.ai/v1/m2m/token", {
    method: "POST",
    headers: {
      Authorization: authorization,
      "Content-Type": "application/json",
    },
  });

  const { token, expiresOn, error } = await response.json();

  if (error) {
    throw new Error(error);
  }

  return { token, expiresOn };
}

// Usage
const { token, expiresOn } = await generateToken('YOUR_CLIENT_ID', 'YOUR_CLIENT_SECRET');

Browser-based authentication exposes your credentials in client-side code. This is suitable for prototyping and demos, but for production applications consider using a backend proxy to keep credentials secure.

Node.js (Backend)

For server-side applications:

async function generateToken(clientId, clientSecret) {
  const authorization = "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString('base64');

  const response = await fetch("https://api.multiset.ai/v1/m2m/token", {
    method: "POST",
    headers: {
      Authorization: authorization,
      "Content-Type": "application/json",
    },
  });

  const { token, expiresOn, error } = await response.json();

  if (error) {
    throw new Error(error);
  }

  return { token, expiresOn };
}