Authentication

Authenticate a partner and return a session token

The combination of xClientID and xClientSecret identify the master of the calling brokerID.

The brokerID is then verified to assess if it belongs to that master and has api access.

Lastly the userID is verified to ensure it belongs to the calling broker and that also has api access. For this to be accomplished the user must be previously created in the Partners Portal system as well as the broker and the master.

The token lasts for 30 minutes of inactivity and can be used in further requests by adding it to the "Authorization" header as a Bearer token.

For every subsequent request with the token the inactivity timer is reset.