Authentication

The Reseller API supports API keys for server-to-server integrations and OAuth2 client credentials for applications that need token lifecycle control.

API Key Authentication

API keys are the simplest option for trusted backend services and operational scripts.

Open Settings > API Keys in the reseller portal.
Create a key with a descriptive name.
Select only the scopes required by your integration.
Copy the key and store it securely.

Authorization: Bearer rsk_xxxxxxxxxxxxxxxxxxxx

X-API-Key: rsk_xxxxxxxxxxxxxxxxxxxx

API Key Scopes

Scope	Description
companies:read	View companies.
companies:write	Create and update companies.
companies:delete	Delete companies.
seats:read	View seat allocations.
seats:write	Modify seat allocations.
users:read	View users across companies.
users:write	Create and update users.
users:delete	Delete users from companies.
reports:read	Access training and phishing reports.

OAuth2 Authentication

OAuth2 client credentials are recommended when you need short-lived access tokens or a separate client secret lifecycle.

curl -X POST "https://api.empowsec.com/v1/reseller/oauth/token" 
  -H "Content-Type: application/json" 
  -d '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

<?php

$response = file_get_contents('https://api.empowsec.com/v1/reseller/oauth/token', false, stream_context_create([
    'http' => [
        'method' => 'POST',
        'header' => 'Content-Type: application/json',
        'content' => json_encode([
            'grant_type' => 'client_credentials',
            'client_id' => 'YOUR_CLIENT_ID',
            'client_secret' => 'YOUR_CLIENT_SECRET',
        ]),
    ],
]));

$token = json_decode($response, true);
echo $token['access_token'];

const response = await fetch('https://api.empowsec.com/v1/reseller/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        grant_type: 'client_credentials',
        client_id: 'YOUR_CLIENT_ID',
        client_secret: 'YOUR_CLIENT_SECRET',
    }),
});

const { access_token } = await response.json();

Token Response

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "companies:read companies:write seats:read"
}

Best Practices

Protect credentials: Do not expose API keys or client secrets in browsers, mobile apps, logs, or repositories.
Use minimal scopes: Grant only the permissions required by the integration.
Rotate regularly: Replace keys on a schedule and immediately after suspected exposure.
Handle expiration: OAuth2 access tokens expire after one hour.

Type	Expiration
API Key	No automatic expiry until revoked or deleted.
OAuth2 Access Token	1 hour (3600 seconds).