Authorization

When you want to start invoke the mower APIs, you must to obtain a Bearer token first.

You can call the Authorization API to get it.


API endpoint:   https://id.mammotion.com
request path:   /oauth2/token
method:         POST
headers:        { "Content-Type": "application/x-www-form-urlencoded" }
data:           {
                  "client_id": <your client_id>,
                  "client_secret": <your client_secret>,
                  "grant_type": "client_credentials"
                }

Example request (get token by credential):


curl --location --request POST 'https://id.mammotion.com/oauth2/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'client_id=<your client_id>' \
  --data-urlencode 'client_secret=<your client_secret>' \
  --data-urlencode 'grant_type=client_credentials'

Example response:


{
  "access_token": "eyJCI6IkpXVCJ9...xwRJssw5c", // token for Mower APIs
  "refresh_token": "XXXXXX", // if refresh_token not expires, you can use this to retrieve a new access_token
  "expires_in": 3600, // expires in seconds
  "token_type": "Bearer"
}

Example request (get token by refresh_token):


curl --location --request POST 'https://id.mammotion.com/oauth2/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'client_id=<your client_id>' \
  --data-urlencode 'client_secret=<your client_secret>' \
  --data-urlencode 'refresh_token=${refresh_token}' \
  --data-urlencode 'grant_type=refresh_token'

Use access token

You can now use your access_token to call the Mower API endpoints that you have connected with your application.

In the token object above we see that we have the properties:

access_token
expires_in

In the example above the access_token expires after 3600 seconds. The Authentication API will send a HTTP 401 if the access_token is invalid, or is expired. That’s when it is time to use the client_credentials again.

An access token can be obtained for your application and must be used to communicate with our REST APIs. Users should re-use the access token until it expires instead of creating new tokens each time.