• OAuth 2 Tokens
• Obtaining a ClientID for your Application
• Switch Organizations

Authorization

To try the API without implementing an OAuth flow, use the API Token Generator to get a refresh token for the sandbox client.

Most API requests require authentication via a bearer OAuth2 token. These tokens can be obtained from the ezeep Authentication Service. This service implements the following Authorization Flows:

• Authorization Code Flow: confidential clients, such as server-side backends that can keep a client secret
• Authorization Code Flow with PKCE: public clients, such as mobile, desktop, single-page and CLI applications
• Device Authorization Flow
• Resource Owner Password Flow (Restricted use only)

OAuth 2 Tokens

You can use an OAuth 2 access token to authenticate with the API by passing it in the Authorization header.

Example of using the OAuth2 token in the header:

curl --header "Authorization: Bearer <access_token>" https://printapi.ezeep.com/sfapi/GetPrinter/

Note: All OAuth access tokens are valid for one hour after they are created.

All APIs use JSON for data serialization unless otherwise specified.

Obtaining a ClientID for your Application

Be sure to keep the client secret secure and never share it, especially in components that you will pass to others. If it is necessary to embed the client secret in the application, you may be using an incorrect authentication method.

Organization administrators can create a client ID and optional client secret themselves, via the Managing OAuth clients REST API or, for public PKCE clients, the MCP self-service prompt. Please also register your redirect URI(s) with the client. The redirect URI is where the user is redirected to after they have granted permissions to your application. This is typically a URL on your server where you can handle the authorization code or access token. Only with this final redirection the code needed for getting the access_token and optionally a refresh_token will be provided.

Switch Organizations

By default, an access token is issued for the user’s Private organization. To switch to another organization, use the existing access_token to fetch the list of organizations.

GET 'https://account.ezeep.com/v1/organizations/'

Supported attributes:

Example Request shell curl --location 'https://account.ezeep.com/v1/organizations/' \ --header 'Authorization: Bearer <access_token>' Example Response

{
    "count": 2,
    "next": null,
    "previous": null,
    "results": [
        {
            "id": "3d119e0a-e212-4b23-a4d5-de5820678f27",
            "name": "Private",
            "azure_profile": null,
            "owner": null,
            "roles": [
                "admin"
            ]
        },
        {
            "id": "9d501982-c0ce-1ee2-50f2-562090efff09",
            "name": "Organization X",
            "azure_profile": null,
            "owner": null,
            "roles": [
                "user"
            ]
        }
    ]
}

Now call the refresh_token API using grant_type=switch_organization and also pass the organization_id

POST 'https://account.ezeep.com/oauth/access_token/'

Supported attributes:

Example Request: shell curl --location 'https://account.ezeep.com/oauth/access_token/' \ --header 'Authorization: Basic <base64_encoded_client_id>' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=switch_organization' \ --data-urlencode 'scope=printing' \ --data-urlencode 'refresh_token=qm77WJajUQfEv8IM03VmI0vLk1bau8ek' \ --data-urlencode 'organization_id=9d501982-c0ce-1ee2-50f2-562090efff09'

Example Response: json { "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...", "token_type": "Bearer", "expires_in": 3600, "scope": "printing", "refresh_token": "qm77WJajUQfEv8IM03VmI0vLk1bau8ek" }

This refresh_token shall be reused later on for further access_token.