POST/v2/auth/token

auth-token (API)

Exchange an access key and secret for a bearer token. There is no refresh cookie.

No tokenAuthority: permitAllhttps://api1.vacaychi.com/user

This is the only login for an API integration. Email and password are not accepted. BlueTech issues the access key and secret once, against an account whose only role type is API_CLIENT and which holds B2C_API_LOGIN. The request must come from an IP on that client’s allow-list.

The access token is a JWT for that linked user. Send it as Authorization: Bearer on every later call. When it expires, call this endpoint again. POST /v2/auth/refresh does not accept this account.

cURL

bash

curl -X POST https://api1.vacaychi.com/user/v2/auth/token \
  -H "Content-Type: application/json" \
  -d '{"accessKey":"ak_…","secret":"sk_…"}'

Headers

Content-Typeapplication/json

required

JSON body

Content-Type

application/json

required

JSON body

Request

JSON

{
  "accessKey": "ak_…",
  "secret": "sk_…"
}

Body fields

accessKeystring

required

Client access key, prefixed ak_

secretstring

required

Client secret, prefixed sk_. Shown once when the client is created.

`accessKey` string required	Client access key, prefixed ak_
`secret` string required	Client secret, prefixed sk_. Shown once when the client is created.

Response

200

{
  "message": "Success",
  "data": {
    "accessToken": "eyJhbGciOiJSUzI1NiIs...",
    "expiresIn": 600
  },
  "error": null
}

Response fields

accessTokenstring

Bearer token for every other endpoint

expiresInnumber

Access-token lifetime in seconds. Call this endpoint again when it lapses. There is no refresh token.

`accessToken` string	Bearer token for every other endpoint
`expiresIn` number	Access-token lifetime in seconds. Call this endpoint again when it lapses. There is no refresh token.

Business rules

The secret is stored as a hash. A wrong key and a wrong secret are indistinguishable.
allowedIps is an exact IPv4 or IPv6 address, or an IPv4 CIDR such as 203.0.113.0/24. An empty list cannot log in. 127.0.0.1 and ::1 are the same address.
The same allow-list is checked on every later /v2 call that sends this access token, on the user service and the booking service. A disabled client, a changed list, or a call from an IP that is no longer allowed is 401, even while the token is unexpired.
B2C_API_LOGIN is what allows this endpoint to issue a token. It does not authorize search, cart, or ticketing on its own. Those calls need the matching B2C authorities on the same role.

Errors

400validation failed

accessKey or secret missing

401Invalid Credentials

Unknown key, wrong secret, IP not allowed, client or linked user disabled, user is not API_CLIENT only, or the user lacks B2C_API_LOGIN. Every failure uses this one message.

HTTP	message	When
400	validation failed	accessKey or secret missing
401	Invalid Credentials	Unknown key, wrong secret, IP not allowed, client or linked user disabled, user is not API_CLIENT only, or the user lacks B2C_API_LOGIN. Every failure uses this one message.