Authorize requests from your external CRM to the B2COPY API using a service admin and signed JWT tokens (ES256). This page covers prerequisites, key generation, token issuance, and obtaining/refreshing B2COPY tokens.
Prerequisites
- Create a service admin in the Admin panel on whose behalf the CRM makes API requests (it is recommended to restrict it to specific IP addresses).
- Configure your CRM to generate signed JWTs whose claims include
admin_id(the service admin id),device_ip(the request IP), andkey_id(the private key id).
Generate keys
Generate an EC (P-256) key pair for signing and verifying tokens:
# Private key
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
-out ec_private_pkcs8.pem
# Public key
openssl pkey -in ec_private_pkcs8.pem -pubout -out ec_public.pemSecurity
Keep the private key secret and never share it. Provide only the public key to the B2COPY support team — it is used to verify your signed JWTs.
Contact B2COPY support
To finish the integration, send the support team your public key (ec_public.pem), the unique key identifier, and the IP addresses that will call the API. Support registers your integration and configures the public key.
Obtain access and refresh tokens
POST [host]/api/admin/auth/v2/admin/adminservice/authexternalcrm| Name | Type | Required | Description |
|---|---|---|---|
| external_token | string | Yes | The signed JWT generated by your CRM. |
curl -X POST "[host]/api/admin/auth/v2/admin/adminservice/authexternalcrm" \
-d '{ "external_token": "<your-generated-jwt-token>" }'The response returns access and refresh tokens for the service admin; include the access token in the Authorization header of all other requests.
{
"accessToken": "<access-token>",
"refreshToken": "<refresh-token>"
}Refresh the access token
POST [host]/api/admin/auth/v2/admin/adminservice/refreshtokencurl -X POST "[host]/api/admin/auth/v2/admin/adminservice/refreshtoken" \
-H "Authorization: Bearer <refreshToken>"Returns a new access/refresh token pair.
