Authentication

Partner API v2 and the sandbox use the same authentication method: exchange an API key ID and secret for a short-lived JWT, then send that JWT as a Bearer token on all other requests.

The only difference between environments is the base URL (and which key pair you use). Auth paths and request/response shapes are identical.

Use sandbox credentials against the sandbox base URL; use production credentials against /v2. Do not mix credentials across environments.

Obtain a JWT

POST /auth is the only endpoint that does not require a Bearer token.

Production

POST https://api.phonelineplus.com/v2/auth
Content-Type: application/json

{
  "keyID": "00000000-0000-0000-0000-000000000000",
  "secret": "your-production-api-secret"
}

Sandbox

Same request body and response — change only the host path prefix:

POST https://api.phonelineplus.com/sandbox/auth
Content-Type: application/json

{
  "keyID": "00000000-0000-0000-0000-000000000000",
  "secret": "your-sandbox-api-secret"
}

Response

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "Bearer",
    "expires_in": 3600
}

Use the JWT

Include the token on every other request. Use the same base URL you used for /auth:

GET https://api.phonelineplus.com/v2/customers
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

GET https://api.phonelineplus.com/sandbox/customers
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Security practices

• Store keyID and secret only on secure server-side systems.
• Never embed credentials in mobile apps, browser JavaScript, or public repos.
• Refresh tokens proactively using expires_in; do not wait for the first 401.
• On 401 Unauthorized, obtain a new JWT and retry once before treating it as a configuration error.

Errors

See Errors for general error handling.