For AI agents: a documentation index is available at the root level at /llms.txt and /llms-full.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
GuidesAPI Reference
GuidesAPI Reference
  • Get started
    • Introduction
    • Quickstart
    • Authentication
  • Core concepts
    • Callout lifecycle
    • Customers & customer sources
    • Subscriptions & coverage
  • Integration guides
    • Personal Safety
    • Fixed Locations
    • Device & payment gateway
    • Webhooks
    • Go-live
LogoLogo
On this page
  • How it works
  • Token types
  • Token lifetime
Get started

Authentication

Was this page helpful?
Previous

Callout lifecycle

Next
Built with

AURA authenticates every request with a bearer token (a JWT) generated from your clientId and clientSecret. These credentials identify your integration — your customer source — and must only ever be used from a backend.

How it works

  1. Exchange your server credentials for a bearer token.
  2. Send that token in the Authorization header on every request.
  3. Request a new token when the current one expires.

For the exact request and response, see Exchange credentials for a token in the API Reference.

Token types

  • Server token — for backend integrations. Carries the full access of your customer source.
  • Callout-scoped token — a narrower token limited to a single customer’s callout flow. Use it for sessions that should not carry full access. See Mint a callout-scoped token.

Token lifetime

Tokens expire after a fixed period. Refresh by requesting a new token rather than minting one per request, and never expose credentials or tokens in client applications.

First-pass migration of the public documentation. Confirm credential issuance and environment URLs with your AURA contact before go-live.