# Authorization management

### Endpoints

<table><thead><tr><th width="113">Method</th><th>Endpoint</th></tr></thead><tbody><tr><td><mark style="color:blue;"><code>GET</code></mark></td><td><a href="#access-token"><code>https://app.insurehero.io/api/shield/v1/auth/authorize</code></a></td></tr></tbody></table>

### Access token

Get an accessToken to start using the Shield API

## Authorize channel to use API

<mark style="color:blue;">`GET`</mark> `https://app.insurehero.io/api/shield/v1/auth/authorize`

You will need an authorization token to send requests to the integrations API.&#x20;

Each token has a lifespan of 1 hour.

#### Headers

| Name                                        | Type   | Description               |
| ------------------------------------------- | ------ | ------------------------- |
| x-api-key<mark style="color:red;">\*</mark> | string | Your integrations api key |

#### Example Response

{% tabs %}
{% tab title="200: OK Authorized" %}

```typescript
{
    data: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.."; // accessToken
}
```

{% endtab %}

{% tab title="400: Bad Request Missing x-api-key header" %}

```json
{
    "error": "Request contains malformed data",
    "details": "Bad Request Missing x-api-key header"
}
```

{% endtab %}

{% tab title="401: Unauthorized Invalid api key" %}

```json
{
    "error": "Invalid or expired access token",
    "details": "Invalid api key"
}
```

{% endtab %}

{% tab title="429: Too Many Requests API rate limit exceeded" %}

```json
{
    "error": "API ratelimit exceeded",
    "details": "Too Many Requests API rate limit exceeded"
}
```

{% endtab %}

{% tab title="402: Payment Required Pending payment" %}

```json
{
    "error": "Pending payment",
    "details": "Payment Required Pending payment"
}
```

{% endtab %}
{% endtabs %}

#### Attributes

<table><thead><tr><th width="139">Name</th><th>Description</th></tr></thead><tbody><tr><td>data</td><td>Access token used for authentication and API requests</td></tr><tr><td>x-api-key</td><td>A unique key assigned to each channel, used for authentication and authorization in API requests</td></tr></tbody></table>

### Refresh access token

Each accessToken comes with a 1 hour lifespan. This means, you will need to check before each API call wether your accessToken is still valid.&#x20;

* **If the token is still valid:**  We recommend at least 5 minutes remaining. If it is valid, continue making request.
* **If the token is expired or close to:** We recommend if it has less than 5 minutes remaining or is already expired, then call the authorize endpoint to request a fresh accessToken.