Authentication

Two ways to authenticate. Both use the same Client ID / Client Secret pair.

Option 1: Bearer token (recommended)

Exchange your credentials for a short-lived token, then send it on every request.

curl -X POST https://sandboxclient-api.roofangle.com/v4/auth/token \
  -H "Content-Type: application/json" \
  -d '{"clientId": "ra_client_XXXX", "clientSecret": "YOUR_SECRET"}'

{ "accessToken": "eyJhbGciOi...", "expiresIn": 3600, "tokenType": "Bearer" }

Then:

Authorization: Bearer eyJhbGciOi...

Tokens expire after 1 hour. On a 401, request a new token and retry once.

TIP

Cache the token and reuse it until it expires. Don't request a new token per call.

Option 2: API key header (server-to-server)

Skip token management entirely by sending your credentials on each request:

x-api-key: ra_client_XXXX:YOUR_SECRET

Base64-encoded also works:

x-api-key: base64(ra_client_XXXX:YOUR_SECRET)

Use this only from servers you control, never from a browser or mobile app.

Code examples

Node.js

const res = await fetch('https://sandboxclient-api.roofangle.com/v4/auth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ clientId, clientSecret }),
});
const { accessToken } = await res.json();

C#

var res = await http.PostAsJsonAsync(
  "https://sandboxclient-api.roofangle.com/v4/auth/token",
  new { clientId, clientSecret });
var token = (await res.Content.ReadFromJsonAsync<TokenResponse>())!.AccessToken;

Python

import requests
r = requests.post("https://sandboxclient-api.roofangle.com/v4/auth/token",
                  json={"clientId": client_id, "clientSecret": client_secret})
token = r.json()["accessToken"]