Authentication and Token Management

CRD exposes two token operations. Use the one configured for your client and deployment.

• POST /api/OAuth2/token — OAuth 2.0 client credentials.
• POST /api/Login/token — CRD user login.

The API reference lists the request schemas. Do not send credentials in query strings. Treat returned access tokens as secrets and send them in the Authorization: Bearer <token> header when calling protected operations.

Public health check

GET /api/Service/Ping does not require a token. Use it to confirm API reachability. Other protected operations require bearer authentication.

Typical request sequence

1. Request a token from the configured token endpoint.
2. Use the returned access token in the bearer header.
3. When a protected call returns 401, check the token, credentials, authorization header, and API security configuration; request a new token if needed.

Token lifetime and refresh behavior depend on deployed authentication configuration. Follow returned token metadata and deployment settings. See the API Reference for exact fields.