Authentication

Overview

Before you can access any of the Curosa API endpoints, you need to authenticate and obtain an API token. This token must be included in the Authorization header of all subsequent API requests.

Obtaining an API Token

Send a POST request to the login endpoint using your Curosa supplier portal credentials.

Endpoint: POST https://curosa.com/api/v1/login

Request

Set the Content-Type header to application/json and provide your credentials in the request body:

curl --location 'https://curosa.com/api/v1/login' \
--header 'Content-Type: application/json' \
--data '{
    "email": "your@email.address",
    "password": "your_supplier_portal_password"
}'

Request Body:

Response

Upon successful authentication, you will receive a 200 OK response containing your API token:

{
    "message": "Authenticated",
    "status": "success",
    "data": {
        "token": "5|VivSxZyTcpL1xJTESTTESTTESTj8djslmaI4FeB89e4ba1c"
    }
}

Using Your Token

Include the token as a Bearer token in the Authorization header of every subsequent API request:

Authorization: Bearer 5|VivSxZyTcpL1xJTESTTESTTESTj8djslmaI4FeB89e4ba1c

For example:

curl --location 'https://curosa.com/api/v1/products' \
--header 'Authorization: Bearer 5|VivSxZyTcpL1xJTESTTESTTESTj8djslmaI4FeB89e4ba1c'

Token Security

• Keep your API token secure and never share it publicly
• Treat your token like a password — do not commit it to source control or expose it in client-side code
• If you believe your token has been compromised, request a new token immediately; this will automatically invalidate all other active tokens on your account

Rate Limiting

To protect the system from brute force attacks, the login endpoint is rate limited to 10 requests per hour. Exceeding this limit will return a 429 Too Many Requests response.