API Authentication

Use OAUTH2 to authenticate requests

In general TUI APIs are protected to be accessed with OAuth2 Bearer token. If in case specific authentication or session creation steps are needed, those are documented in the specific API products.

Bearer token can be obtained from the general /oauth2/token endpoint. You will need an app with a valid API subscription for the API and environment you want to use (e.g. you can use playground app credentials to access a production API endpoint but you can have apps that subscribe both playground and production endpoints). Follow the information on the page authentication into the portal to access app credentials. You can use http basic authentication (rfc 2617) and put base64(consumer_id:consumer_secret) values as authorization header for the token endpoint or you include client_id, client_secret as additional form values. 

Example to get an OAuth2 token for the playground environment using OAuth2 client credentials flow (rfc6749) with basic auth:

POST /oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Authorization: Basic ABCDefghijkl=
Host: playground.api.tui
Content-Length: 29

grant_type=client_credentials

Example to get an OAuth2 token for the prod environment using OAuth2 client credentials flow (rfc6749) with form values:

curl --request POST \
  --url https://prod.api.tui/oauth2/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=$CONSUMER_ID_VALUE \
  --data client_secret=$CONSUMER_SECRET_VALUE

After the successful call you will receive a response with an access token, you can use as bearer token for any further API calls until the next hour.

{
	"token_type": "Bearer",
	"access_token": "ABCDEFGHIJKLMN",
	"client_id": "myclientidABCDEFGH",
	"scope": "scope1 scope2",
	"expires_in": 3599,
	"issued_at": 1660127710741
}