Server-to-Server Authentication

The Partner API uses the OAuth2 Client Credentials flow for secure server-to-server communication.

For server-to-server communication, this API uses the OAuth2 Client Credentials flow. Please feel free to contact your account manager to receive your initial admin username and password.

Prerequisites

Receive Initial Credentials

Contact your account manager to receive your initial admin username and password.

Please make sure you change your password after your first login.

Register a New Application

Open API Applications

In the Console sidebar, open Configuration → API (https://fleet.podero.com/configuration/api) and click Create application. This requires the organization admin role (or Podero support).

Configure Application

Fill in the application details:

Name: Your application name
Grant type: Select Client credentials

Save Credentials Immediately

Immediately copy the client ID and the client secret and keep them somewhere safe. The client secret is shown only once; you will not be able to retrieve it later.

Click I saved the credentials after copying your credentials.

Generating an Access Token

To get an access token and to be able to use the API, you need to make a request to the token endpoint with a Basic Auth header using your base64 encoded client ID and secret.

You may need to use a base64 encoder tool to get the encoded string. For example, DevToys is a useful tool for this purpose.

Request

curl -X POST 'https://app.podero.com/oauth2/token/' \
  -H 'Authorization: Basic base64_encode(client_id:client_secret)' \
  -H 'Cache-Control: no-cache' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "client_credentials"
  }'

import requests
import base64

# Encode credentials
credentials = f"{client_id}:{client_secret}"
encoded = base64.b64encode(credentials.encode()).decode()

# Request access token
response = requests.post(
    'https://app.podero.com/oauth2/token/',
    headers={
        'Authorization': f'Basic {encoded}',
        'Cache-Control': 'no-cache',
        'Content-Type': 'application/json'
    },
    json={'grant_type': 'client_credentials'}
)

token_data = response.json()
access_token = token_data['access_token']

const clientId = 'your_client_id';
const clientSecret = 'your_client_secret';

// Encode credentials
const credentials = btoa(`${clientId}:${clientSecret}`);

// Request access token
const response = await fetch('https://app.podero.com/oauth2/token/', {
  method: 'POST',
  headers: {
    'Authorization': `Basic ${credentials}`,
    'Cache-Control': 'no-cache',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    grant_type: 'client_credentials'
  })
});

const tokenData = await response.json();
const accessToken = tokenData.access_token;

Response

You will receive a response containing an access token, as well as the expiration time.

{
  "access_token": "PaZDOD5UwzbGOFsQr34LQ7JUYOj3yK",
  "expires_in": 36000,
  "token_type": "Bearer",
  "scope": "read write"
}

string

required

Bearer token for API authentication. Use this in the Authorization header for all subsequent API requests.

integer

required

Token lifetime in seconds. Typically 36000 seconds (10 hours).

string

required

The type of token. Always “Bearer” for this flow.

string

required

The scopes granted to this token. Typically “read write” for full access.

Make sure you store these credentials securely and refresh the token in a timely manner to avoid losing access to the API.

Using the Access Token

For subsequent requests to the API, include the access token in the Authorization header:

Authorization: Bearer {access_token}

Example API Request

curl -X GET \
  'https://app.podero.com/api/partners/v2.0/org/{org_id}/users' \
  -H 'Authorization: Bearer {access_token}' \
  -H 'Accept: application/json'

headers = {
    'Authorization': f'Bearer {access_token}',
    'Accept': 'application/json'
}

response = requests.get(
    f'https://app.podero.com/api/partners/v2.0/org/{org_id}/users',
    headers=headers
)

const headers = {
  'Authorization': `Bearer ${accessToken}`,
  'Accept': 'application/json'
};

const response = await fetch(
  `https://app.podero.com/api/partners/v2.0/org/${orgId}/users`,
  { headers }
);

Refreshing the Token

Refreshing the token can be done with the same request you used to get the initial token. There is no refresh token - simply request a new access token using your client credentials.

When your token is about to expire, make the same POST request to /oauth2/token/ with your client credentials to obtain a new access token.

Best Practices

Secure Storage

Store client secrets in environment variables or secure vaults
Never commit credentials to source control
Use different credentials for each environment (production, sandbox)

Token Management

Implement automatic token refresh before expiration
Handle 401 Unauthorized responses by refreshing the token
Cache tokens to avoid unnecessary token requests

Error Handling

Implement retry logic for transient failures
Log authentication errors for debugging
Monitor token expiration and refresh patterns

Next Steps

Getting Started

Follow our step-by-step tutorial

User Journeys

Explore common workflows

Overview

Getting Started

End-User Workflows

Back-Office Workflows

Notifications

Explainers

API Reference

Heat Pumps

Electric Vehicles

Solar Inverters

Authentication

Server-to-Server Authentication

Prerequisites

Register a New Application

Generating an Access Token

Request

Response

Using the Access Token

Example API Request

Refreshing the Token

Best Practices

Next Steps

Getting Started

User Journeys

​Server-to-Server Authentication

​Prerequisites

​Register a New Application

​Generating an Access Token

​Request

​Response

​Using the Access Token

​Example API Request

​Refreshing the Token

​Best Practices

​Next Steps

Getting Started

User Journeys

Server-to-Server Authentication

Prerequisites

Register a New Application

Generating an Access Token

Request

Response

Using the Access Token

Example API Request

Refreshing the Token

Best Practices

Next Steps