Skip to main content

API Authentication

Purpose​

xTrakt APIs require an authenticated product context, either through a platform session/token flow or an API key for integrations.

Browser Session Flow​

  1. Authenticate with the SSO API using OpenID Connect PKCE.
  2. Receive an SSO access_token.
  3. Exchange that token with POST /user/get-platform-token.
  4. Exchange the redirect code with POST /auth/exchange-redirect-code.
  5. Persist the platform session in the xtrakt_session HttpOnly cookie.
  6. Send the companion CSRF token on mutating requests.

Integration Flow​

  1. Generate an API key for the tenant.
  2. Store it securely.
  3. Send it in the Authorization header.
  4. Scope the integration to one tenant and use case.
caution

Some xTrakt backend responses are returned with Content-Type: text/plain while the body contains JSON. API clients should parse the response body as JSON even when the content type is not application/json.