Nymble Commerce API Authentication — Login and Token Access

The authentication endpoints let you obtain access tokens and refresh user token claims. Call these endpoints before making any other API calls — every other endpoint requires a valid token in the Authorization header.

Authenticate with your organization credentials to receive a JWT access token. Use this token in the Authorization: Bearer header for all subsequent requests.

This endpoint is rate limited to 10 requests per minute per ClientId. Cache and reuse your token until it expires rather than authenticating on every request.

Request body

string

required

Your organization code. You can find this in the Nymble Commerce dashboard under Settings → API Access.Example: "org_12345"

string

required

Your API client ID. Generated when you create an API access credential.Example: "sdaf43tfsdg45dg"

string

required

Your API client secret. Treat this like a password — never expose it in client-side code or commit it to source control.Example: "QsFdas%4F1asr23tgb675%3"

Example request

curl -X POST https://api.achievemomentum.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "OrgCode": "org_12345",
    "ClientId": "sdaf43tfsdg45dg",
    "ClientSecret": "QsFdas%4F1asr23tgb675%3"
  }'

const response = await fetch('https://api.achievemomentum.com/api/auth/login', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    OrgCode: 'org_12345',
    ClientId: 'sdaf43tfsdg45dg',
    ClientSecret: 'QsFdas%4F1asr23tgb675%3',
  }),
});

const { AccessToken, ExpiresIn } = await response.json();

// Use the token in subsequent requests
const apiResponse = await fetch('https://api.achievemomentum.com/api/organization', {
  headers: {
    Authorization: `Bearer ${AccessToken}`,
  },
});

Response fields

string

The access token to include in the Authorization: Bearer header of all subsequent requests.Example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

string

The token type identifier. Always "api-key". Pass the AccessToken value using the Bearer scheme in your Authorization header regardless of this field.

integer

The token lifetime in seconds. Tokens are valid for 86400 seconds (24 hours) by default. Request a new token before this window elapses.

Example response

{
  "AccessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tLyIsInN1YiI6IjEyMzQ1Njc4OTAiLCJleHAiOjE3MzU2ODk2MDB9.fake_signature",
  "TokenType": "api-key",
  "ExpiresIn": 86400
}

Error responses

Status	Description
`401 Unauthorized`	The `ClientId` / `ClientSecret` combination is invalid, or the `OrgCode` does not match the credentials.
`429 Too Many Requests`	You have exceeded the rate limit of 10 requests per minute. Wait and retry.

POST /api/auth/access

Enriches an existing access token with organization-specific claims for a given user. Pass the organization and user identifiers in the request body; the API returns the commerce context — customer number, price tier, and currency — that Nymble Commerce will use to scope data correctly for that user.

This endpoint requires a valid access token in the Authorization header. Obtain one via POST /api/auth/login before calling this endpoint.

Authentication

Authorization: Bearer {your_access_token}

Request body

string

required

The internal Nymble Commerce organization ID to enrich the token for. This scopes the returned claims to the correct organization.Example: "6d24ab9faf9e034e881fcd97"

string

required

The Nymble Commerce user ID of the user to retrieve commerce context for.Example: "kp_abc123def456"

Example request

cURL

curl -X POST https://api.achievemomentum.com/api/auth/access \
  -H "Authorization: Bearer {your_access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "OrganizationId": "6d24ab9faf9e034e881fcd97",
    "UserId": "kp_abc123def456"
  }'

Response fields

string | null

The customer account number linked to this user in the specified organization. null if the user has no customer association.Example: "C-10042"

string | null

The pricing tier assigned to this user’s customer account. Used to apply the correct price list on product queries.Example: "Wholesale"

string | null

The ISO 4217 currency code for this user’s organization context.Example: "USD"

Example response

{
  "CustomerNumber": "C-10042",
  "PriceTier": "Wholesale",
  "CurrencyCode": "USD"
}

Error responses

Status	Description
`401 Unauthorized`	The bearer token in the `Authorization` header is missing, expired, or invalid.
`400 Bad Request`	`OrganizationId` or `UserId` is missing or malformed.

Overview

Auth & Users

Catalog

Commerce

Analytics & Tools

Nymble Commerce API Authentication — Login and Token Access

Request body

Example request

Response fields

Example response

Error responses

POST /api/auth/access

Authentication

Request body

Example request

Response fields

Example response

Error responses

​POST /api/auth/login

​Request body

​Example request

​Response fields

​Example response

​Error responses

​POST /api/auth/access

​Authentication

​Request body

​Example request

​Response fields

​Example response

​Error responses

POST /api/auth/login

Request body

Example request

Response fields

Example response

Error responses

POST /api/auth/access

Authentication

Request body

Example request

Response fields

Example response

Error responses